Author Archives: colo1

  HomeAgila Ltd | Glasgow, Aberdeen, Edinburgh Computer Network IT Support   : :   Articles by: colo1
Free High-resolution close-up of a smartphone displaying a QR code on its screen. Stock Photo
Posted on By Author colo1 Categories Cybersecurity

QR Code Scams: What They Are and How to Protect Your Business

Article Summary: A QR code scam, sometimes called quishing, hides a malicious web link inside a QR code. Because the link is buried in an image instead of written as text, it slips past the email filters that normally catch bad links, and scanning the code usually moves the victim onto a personal phone that sits outside the company’s security. Microsoft reported a 146% rise in QR code phishing during the first quarter of 2026.

QR codes are part of normal business now.

You scan them to see a menu, pay for parking, connect to Wi-Fi, or open a shared document.

 Attackers know that, and they have started hiding malicious links inside QR codes to get past the security tools that would normally catch a bad link in an email.

The technique has a name, quishing, and it works because a QR code is just an image.

Your email filter reads text, so a link encoded into a QR code can pass straight through. When you scan it, you usually do so on your phone, which sits outside most of the protection your work computer has.

This post covers what a QR code scam is, why it gets past your security, what the common ones look like, and the habits that protect your business.

What is a QR code scam?

A QR code scam is a phishing attack that uses a QR code in place of a written link.

Instead of a clickable URL your email security can inspect, the attacker encodes the web address into a square image.

You scan it with your phone camera, your phone opens the link, and you land on a page built to steal your login or your payment details.

The page on the other end is the same kind of fake you would see in any phishing attack, a login screen made to look like Microsoft 365 or a payment form that copies your bank. The QR code is only the delivery method that gets you there.

Why QR code scams get past your security

Two things make these scams effective.

First, the malicious link is hidden inside an image.

Most email security tools scan the text of a message for known bad links. A QR code is a picture, so the link inside it is not text the filter can read.

The UK’s National Cyber Security Centre points out that not all phishing-detection tools scan images, which is the reason criminals started using QR codes to disguise their links in the first place.

Second, scanning a code moves you onto your phone.

Your work computer probably has web filtering, endpoint protection, and DNS controls that block known bad sites.

Your personal phone usually has none of that. So the moment you scan, you step outside the protection your business pays for, often without realizing it happened.

How common are QR code scams?

The volume is climbing fast. In its report on email threats for the first quarter of 2026, Microsoft said it detected around 8.3 billion email-based phishing threats in those three months.

QR code phishing rose 146% across the quarter, from 7.6 million attacks in January to 18.7 million in March.

By the end of the quarter it had reached its highest monthly volume in at least a year.

Microsoft also found that most of these attacks arrived as PDF attachments, growing from 65% of QR code attacks in January to 70% in March.

The QR code sits inside a PDF, the PDF is attached to an email, and the whole thing looks like an ordinary document until someone scans it.

What QR code scams look like

These are the QR code scams that come up most often.

  • A “security” email. You get a message that looks like it is from Microsoft or your IT team, telling you to scan a code to re-enroll your multi-factor authentication or keep your account active. The code leads to a fake login page.
  • A shared document. An email says a colleague or client has shared a file, and you need to scan the code to view it. The page asks you to sign in first.
  • A fake invoice. A PDF invoice includes a QR code “to pay faster.” The code routes your payment to the attacker.
  • A delivery notice. A text or email about a missed package asks you to scan a code to reschedule. The US Federal Trade Commission has warned about this exact scam.
  • A sticker in the real world. Attackers print QR code stickers and place them over legitimate ones on parking meters, posters, and payment terminals. You think you are paying for parking, and instead you are handing your card details to a stranger.

How to protect your business from QR code scams

Protecting yourself against Quishing comes down to a few habits:

  • Be suspicious of QR codes in emails. A code that arrives by email, especially one that asks you to log in or pay, deserves the same caution as a strange link. The NCSC’s advice is to be wary of scanning QR codes inside emails, even though codes in places like restaurants are usually fine.
  • Check the web address before you act. When you scan a code, your phone shows the link before it opens. Read it. If the address is not the official site you expected, close it.
  • Go direct instead of scanning. If an email says your Microsoft account needs attention, open your browser and type the address yourself, or use a bookmark. Don’t rely on the code to take you to the right place.
  • Watch for urgency. Messages that threaten account closure or a fine “within 24 hours” are trying to rush you past your own judgment. That pressure is itself a warning sign.
  • Use phishing-resistant MFA. If a scam does capture a password, phishing-resistant multi-factor authentication (a passkey, a hardware key, or number-matching in an authenticator app) makes that password much harder to use.
  • Check physical codes for tampering. Before scanning a code on a parking meter or payment terminal, look for a sticker placed over the original.
  • Tell your team. Most people have never been warned about QR code scams. Send your staff a short message with a real example so they know what to watch for.

What to do if someone already scanned one

If you or someone on your team scanned a QR code and entered details on the page that opened:

  1. Change the password for that account right away, along with any other account that used the same password.
  2. Confirm multi-factor authentication is turned on for the account.
  3. Tell whoever manages your IT, so they can check for unusual sign-ins.
  4. If card or banking details were entered, call the bank and watch the account closely.

Acting quickly limits what an attacker can do with the details they captured.

Frequently Asked Questions

Are QR codes safe to use?

Most QR codes are safe. A code on a restaurant table or an official payment terminal is usually fine. The risk comes from codes sent in unexpected emails or texts, and from stickers placed over real codes in public. Treat those with caution.

What is quishing?

Quishing is phishing that uses a QR code instead of a written link. The word combines “QR” and “phishing.” The goal is the same as any phishing attack: to get you onto a fake page that captures your login or payment information.

Can antivirus or email filters stop QR code scams?

Not always. Many email security tools scan the text of a message for bad links, and a QR code hides its link inside an image, so it can slip through. Some products now scan images for codes, but you should not assume the scam will be caught before it reaches you.

Why is a QR code in an email more dangerous than a normal link?

A written link can be inspected by your email security and opened on a managed work computer. A QR code hides the link from those tools and pushes you to scan with your phone, which usually has far less protection than your work device.

What should I do if I scanned a scam QR code but didn’t enter anything?

If you closed the page without typing anything, the risk is low. Close it, don’t go back, and let your IT contact know so they can keep an eye out. If you did enter a password or payment details, follow the recovery steps above.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

MacBook Pro turned-on
Posted on By Author colo1 Categories Cybersecurity

How Small Business Ransomware Attacks Work (And How to Protect Against Them)

Small businesses are the most common ransomware target by volume of incidents, even though many small business owners assume hackers focus on larger organizations. A 22-person company has enough revenue to be worth attacking, no dedicated security team to defend it, and a publicly traceable footprint that takes about an hour to research.

What follows is a step-by-step walkthrough of how a small business gets attacked, written from the attacker’s side. The company in this account is composite, but the methods are accurate to current threat intelligence reporting. After the walkthrough, you’ll see five specific points where the attack would have been stopped by controls that come bundled with security tools most small businesses already pay for.

Monday: how I picked you

I work regular hours and run a small volume operation. My spreadsheet has about 40 prospects per month, and I prefer businesses between 10 and 50 staff. The reason for that range is economics. Large enterprises have security teams, incident response contracts, and lawyers who make recovery expensive on my end. At the other end of the scale, sole traders rarely have enough at stake to bother with. A 22-person commercial services company sits in the right zone: payroll, customer database, project files, supplier relationships, and an owner who will pay to get the lot back. The return per hour is better at this size than at either extreme.

I did not find you through a breach or a tip. I found you on a public business records portal. State business registries, federal contract awards, and county-level licensing databases publish enough detail for me to identify your company, look up your name, estimate your revenue, and pick the most useful person inside the business. One search told me your company name, your registered agent, the contract value of a recent municipal job, and the named contact on the submission.

The fact that nothing has gone wrong at your company yet is the strongest signal I get. It tells me your credentials are probably still valid, your staff has not been trained to spot anything, and nobody has had a reason to change a password. A clean record is the first indicator I look for.

Tuesday: building your org chart for free

I spend about 40 minutes researching your company today using only a browser.

LinkedIn gives me eight of your current employees with their job titles listed. Your office manager has been there for six years and lists “accounts payable, payroll, and supplier invoicing” in her profile summary. Your second admin joined 14 months ago. You list yourself as director, with a sparse profile and a low connection count, which tells me you are unlikely to notice when someone unusual starts engaging with your profile or your company’s social media.

Public business filings confirm your registered business name and your full legal name. A “meet the team” post from two years ago on your Facebook page lists first names and photos, including someone described as helping out in the office a couple of days a week. One of the commenters shares your surname.

I now know who handles your money, what their name is, how long they have been there, what software they probably use (I will check your job ads on Indeed for the phrase “experience with QuickBooks or Sage”), and who in your business has the authority to approve a payment without a second signature.

That last person is my primary target. You are harder to reach and probably more cautious. Your office manager has system access, handles supplier payments, and is busy enough that one more email in her inbox does not get scrutinized the way it might if she had nothing else to do.

I have not spent a dollar yet.

Wednesday: I bought your credentials for $14

Stealer logs are credential packages harvested by infostealer malware that infected someone’s personal device, often months or years earlier. The malware records every username and password typed into the machine, then bundles the data for sale. Marketplaces on Telegram channels and forums let buyers search these logs by company email domain.

I search for your company’s email domain. Two results come back. One is your office manager’s work email, with a password that looks like it was saved in her browser. The other is a personal Gmail address that appears to belong to a family member of yours, probably from a device that shared a home network.

I pay $14 for the package. It takes four minutes.

Your office manager’s password follows a common pattern: a pet or child’s name combined with a year and an exclamation mark. I check it against HaveIBeenPwned, which is the same free database security professionals use, and find that it appeared in a credential dump from a retail loyalty program breach three years earlier. The password has not been changed since.

Your family member’s credentials are more interesting than they look at first. The same password, with minor variations, shows up across a streaming service, a gaming account, and your company’s Microsoft 365 login. The password works. The only thing standing between me and the inbox is the second factor.

Total spend so far: $14.

Thursday: getting past your MFA

Multi-factor authentication stops a lot of attacks, but the implementation matters more than the checkbox.

Simple push-notification fatigue does not work against your office manager’s account. Microsoft enabled number matching by default for all Microsoft Authenticator push notifications in May 2023, which means she would have to type a code from her login screen rather than just tap approve. Push bombing fails against that configuration.

What still works is adversary-in-the-middle (AiTM) phishing. I send your office manager an email designed to look like a routine Microsoft 365 password reset notification, citing the breach that her password appeared in (the same breach I found her credentials in earlier in the week). The link in the email takes her to a page that mirrors the real Microsoft sign-in screen. That page is a proxy I control.

When she enters her password and approves her MFA prompt, my proxy forwards both to the real Microsoft login server. Microsoft validates the credentials, completes the MFA challenge, and issues a session token back to my proxy. I capture the token. She sees a normal login experience on what she thinks is the real Microsoft site, then a “password updated successfully” message.

I am now signed in as her. The MFA prompt succeeded, and the session token sits in my browser instead of hers. Microsoft sees a valid authenticated session and treats my activity as legitimate.

I had a backup plan in case the email did not get clicked. Earlier in the day, I called your office posing as your IT support company, using a name I found in a Google review you had left 18 months earlier. I told your receptionist that we were seeing unusual login activity on the office manager’s account and that I would need her to approve a verification push in the next few minutes. She said the office manager was not at her desk. I said no problem, I would try again later. The call cost me nothing.

By Thursday night, I am inside your office manager’s Microsoft 365 account. I set up an inbox forwarding rule so her emails copy to an address I control without notifying her, then I wait.

Friday 2:47pm: why I waited 36 hours before encrypting

I spend 36 hours reading email before I encrypt anything. That dwell time is how I size the ransom correctly.

In those 36 hours, I find your cyber insurance policy attached to an email from your broker, with a cyber liability sub-limit of $250,000. A bank reconciliation your office manager sent you two weeks ago shows your business account at around $180,000 at month end. Your customer list sits in a quote template she emailed to herself, and a message thread with a municipal project manager mentions a job starting in three weeks with a hard deadline you cannot afford to miss.

I set my ransom at $65,000 in cryptocurrency. That figure is low enough that you will pay rather than fight it, high enough that it is worth my time, and well within what I know you can access. Ransoms set above 10 percent of visible liquid assets tend to get contested. The figure I picked sits below that line.

I deploy the encryption payload at 2:47pm on Friday. The timing is deliberate. Your bookkeeper finishes at 3pm on Fridays, which I know from an out-of-office reply I saw in the forwarded emails. You are on a job site, with your calendar synced to the shared inbox. The person most likely to notice something wrong and call for help is already gone, and the person with the authority to make decisions is unreachable.

By the time anyone understands what has happened, it is a Friday evening, every file on your shared drive is encrypted, and a ransom note sits on every screen in your office.

Total cost to me: $14 for credentials and about six hours of work spread across the week.

Five places this attack would have died

The attack on your business worked because five ordinary things were not in place. None of them were expensive. Most were already bundled into security tools you already pay for.

1. The credential purchase on Wednesday.

HaveIBeenPwned is free. Microsoft Entra password protection can detect and block reused or commonly-compromised passwords across your accounts. Enforcing unique passwords per account, through a password manager and through Entra’s policies, makes a stolen credential purchase useless for me.

2. The MFA bypass on Thursday night.

Microsoft already blocks the simpler push-bombing attack, because number matching has been enabled by default for all Microsoft Authenticator push notifications since May 2023. The current dominant credential-based bypass is adversary-in-the-middle phishing. Defenses include phishing-resistant MFA (FIDO2 hardware keys, passkeys, or Windows Hello for Business), Conditional Access policies that require a compliant or hybrid-joined device, and anti-phishing protection in Microsoft Defender for Office 365. Any one of these would have either prevented the session token capture or made the captured token unusable from my IP address.

3. The inbox forwarding rule.

Microsoft 365 allows admins to block external email forwarding rules at the tenant level. With that block in place, the inbox forwarding rule I used to read 36 hours of email would not have worked. I might have encrypted anyway, but I would have been guessing on the ransom size.

4. The 36-hour dwell time.

Microsoft Defender for Business, included in Microsoft 365 Business Premium, generates an alert when a new inbox forwarding rule is created. If anyone had been watching those alerts, or if the alerts had been routed somewhere visible, I would have been detected on Thursday night. The most impactful change for a business your size is rarely a new product purchase. The improvement comes from someone reviewing the security alerts that the tools you already pay for are already generating.

5. The public business records.

You cannot unpublish a state contracting registry or a federal contract award. That data will stay public. What you can control is what your team chooses to post about their specific responsibilities. Your office manager’s LinkedIn profile listed her financial responsibilities in enough detail to make her the obvious target. That detail is worth a conversation with your team, framed as practical security awareness rather than a rule about what people can post.

Three questions to send your IT provider

These three questions cover most of where the example attack failed. Each one corresponds to a control that comes bundled with security tools you most likely already pay for.

  1. Are we using phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business) for finance, admin, and executive logins?
  2. Is external email forwarding blocked at the tenant level?
  3. Are our security alerts going somewhere, and is someone reviewing them?

Frequently asked questions

Do hackers target small businesses?

Yes. Most ransomware operations target small and mid-sized businesses because the ratio of payout potential to defensive resources is higher than at either extreme of company size. The volume sweet spot is roughly 10 to 50 staff, where there are assets worth encrypting but no dedicated security team to defend them.

What is adversary-in-the-middle (AiTM) phishing?

AiTM phishing is a technique where the attacker hosts a proxy page that mirrors a real login screen, such as Microsoft 365 or Google Workspace. When the user enters credentials and approves the MFA prompt, the proxy captures the resulting session token. The legitimate service treats the login as successful, but the session token ends up in the attacker’s browser. AiTM has become the dominant credential-based attack vector against Microsoft 365 tenants after the default rollout of number matching ended simpler push-bombing attacks.

What is a stealer log?

A stealer log is a package of credentials harvested by infostealer malware from an infected personal device. The logs include browser-saved passwords, session cookies, and stored authentication tokens, and they are sold on underground markets for $10 to $20 per package. The malware that creates them typically infects personal computers through pirated software or malicious browser extensions.

How much does it cost an attacker to compromise a small business?

In the example walkthrough above, the total spend was $14 for stolen credentials and about six hours of work. Costs vary, but the threshold to attempt the kind of attack described in this post sits well below $100.

Are there free tools that would have stopped this attack?

Several of the controls referenced in the walkthrough come bundled with Microsoft 365 Business Premium licenses that businesses in this size range typically already hold. External forwarding restrictions and Defender for Business alerts are configuration changes rather than new purchases. HaveIBeenPwned is a free check available to anyone. Phishing-resistant MFA hardware keys are a small per-user cost compared with the cost of a successful ransomware incident.

Sources and further reading

If any of this walkthrough sounded uncomfortably similar to your environment, the three questions above are a good starting point. Your IT provider should be able to confirm what is in place and what is not within an hour or two. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Free Close-up of a businessman holding and reviewing documents on a wooden desk. Stock Photo
Posted on By Author colo1 Categories Business

How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy

If you have a cyber insurance renewal coming up, the application is probably longer than the one you filled in last time. It’s also more specific. Each new question maps to a control that, if missing, allowed a major 2023 or 2024 claim to escalate. The wording reflects how carriers responded to losses they paid in 2023 and 2024, and how you answer the form matters more than it used to.

This post covers why the application got longer, what each new section is asking, how to answer honestly without overstating your controls, and what to fix in the 30 days before submission. The expensive mistake on a cyber insurance application is rescission, where a future claim is denied because the carrier finds that the controls you declared were not in place at the time.

Why the renewal application got longer

The current generation of cyber insurance applications was shaped by three specific claim events from 2023 and 2024.

The MOVEit supply-chain breach surfaced on May 28, 2023, when Progress Software received the first reports of unusual activity from customers. The Cl0p ransomware group had been exploiting a previously unknown vulnerability in Progress Software’s MOVEit Transfer file-sharing tool, with activity detected by some researchers as early as February of that year. By late 2023, more than 2,650 organizations and over 66 million individuals had been affected, with totals rising further into 2024. Carriers paid claims across that footprint, and the experience reshaped how underwriters ask about third-party software risk.

Then the Change Healthcare ransomware incident in February 2024 froze US healthcare claims processing for weeks. The attacker gained network access on February 12, 2024, and deployed ransomware on February 21, with downstream impact on pharmacies, providers, and patients across the country. HIPAA Journal’s coverage noted that the absence of multifactor authentication on a key entry point made the initial intrusion possible. Industry analysts have estimated the cyber insurance loss from this single event at over $250 million, and the response was tighter questions about backup immutability and incident response readiness.

The Arup deepfake wire fraud, also from early 2024, reframed how underwriters approach social engineering. A finance employee at the engineering firm’s Hong Kong office transferred $25.6 million across 15 wires after a video call with what appeared to be the company’s CFO and other executives, all of whom were AI-generated deepfakes. The fraud went undiscovered for about a week, until the employee contacted Arup headquarters about a “secret transaction.” Out-of-band callback verification for wire transfers is now on every underwriter’s checklist.

If you run an e-commerce store handling cardholder data, a healthcare practice with PHI, an accounting firm or law firm moving client funds, or a real estate brokerage handling escrow, your application is the longest of all. You sit in the loss categories carriers got burned on.

The backup question changed

The backup question on cyber insurance applications has tightened materially since 2023. What used to be a single yes/no question now asks whether those backups are immutable or air-gapped, when they were last tested, and whether they can be deleted by your domain administrator credentials.

Expect wording on your form like: “Are backups stored in an immutable or air-gapped state, tested for restoration within the past 12 months, and inaccessible to domain administrator credentials?”

An immutable backup is one that nobody can delete or alter during a fixed retention window, including someone using stolen administrator credentials. Air-gapped means the backup copy sits on infrastructure that cannot be reached from your production network. CISA’s Stop Ransomware Guide lists immutable, tested backups as a baseline control, which is the same standard most cyber insurance carriers now apply.

“Microsoft 365 backup” is no longer a passing answer on its own. Native Microsoft 365 retention isn’t a backup in the sense the carrier means. Third-party backups that share the same identity perimeter as your production tenant can be wiped by a compromised global admin.

For the immutable backup question, the strongest answer references a backup platform with object lock or write-once-read-many storage enabled, an immutability window of at least 14 days (with 30 days now preferred), credentials separated from your production admin accounts, and a recent successful restore test. Weaker answers describe daily backups to a NAS on the same network with no recent restore test, which typically triggers follow-up underwriting and sometimes a premium adjustment. Answers that leave the immutability question unclear are the ones most likely to push a renewal toward sub-limits or non-renewal.

MFA questions go deeper than one checkbox

MFA was once captured as a single yes/no question on most applications. The current generation asks whether MFA is enforced on email, VPN, remote desktop (RDP), all administrator accounts, and privileged service accounts. The answer needs to be yes on all five for a clean pass.

SMS-based MFA is now treated as a weaker control. SIM-swap attacks and SS7 vulnerabilities have made text codes the weakest authentication factor available. Several carriers ask specifically whether your MFA uses an authenticator app, hardware token, or push with number matching, rather than SMS. If you’re still on SMS for admin accounts, expect a follow-up question or a premium adjustment.

The privileged access management (PAM) question is the one most owners haven’t seen before. PAM is a category of tool that keeps administrator credentials out of regular password managers. A PAM platform vaults privileged credentials, rotates them on use, and logs every session, which means a stolen admin password can’t be used unnoticed for weeks before someone catches it.

A strong PAM answer describes a vaulting tool with credentials rotated on use and session logging enabled. Weaker answers, like admin passwords stored in a shared password manager with annual rotation, will usually trigger follow-up underwriting. Shared admin accounts that never rotate and produce no audit log of who used them are the configuration most likely to result in sub-limits or non-renewal.

Will cyber insurance be denied if you don’t have MFA everywhere? Not always denied outright. Expect significant premium increases, sub-limits on ransomware coverage, or exclusions for any incident that traces back to the unprotected entry point.

The wire transfer and deepfake verification questions

After the Arup case and a string of business email compromise losses, carriers added callback verification questions to their applications. Callback verification means that before sending any wire above a defined threshold (commonly $10,000 or $25,000), the person authorizing the transfer calls the recipient at a phone number previously verified and stored, not the number on the request email.

Expect wording like: “Does your organization require out-of-band verification using a previously known phone number for all funds transfer requests above [threshold], including requests appearing to come from executives?”

Several current applications now ask separately whether staff have been trained on AI voice cloning and deepfake video risks. The Arup case made that question relevant for every carrier writing in professional services.

Accounting firms, law firms with escrow or trust accounts, and real estate brokers will see this section scrutinized most carefully. Anyone moving other people’s money is a soft target and an expensive claim when wire fraud lands.

A strong answer references a written wire transfer policy requiring callback verification to a verified number for transfers above a stated threshold, dual approval, and annual social engineering training that includes deepfake awareness. Informal verification practice without a written policy will usually be flagged for follow-up. Wire transfers authorized by email approval alone are the configuration carriers are now declining to cover at all.

EDR, MDR, and the end of the “we have antivirus” answer

Traditional antivirus scans files against a list of known threats. Endpoint Detection and Response (EDR) watches behavior on each device and flags suspicious activity, such as a process trying to encrypt files or escalate privileges. Managed Detection and Response (MDR) is EDR plus a 24/7 team watching the alerts and responding when something fires at 2am on a Sunday.

Current applications ask whether you have EDR deployed, whether it covers 100% of endpoints including servers, and whether a 24/7 security operations center (SOC) monitors and responds to alerts. The MDR question is increasingly yes or no, and the no answer has pricing consequences.

If you don’t have MDR yet but plan to add it, say so plainly with a timeline. Underwriters can work with “MDR deployment scheduled for Q2 with vendor selected.” They cannot work with vague answers about future plans.

The vendor risk questions

Supply chain questions used to be a single yes/no item. After MOVEit and Change Healthcare, carriers now want a full section on the software vendors holding your data.

Expect questions like: “List your top five software vendors with access to sensitive data and confirm whether each provides a SOC 2 Type II report or equivalent.” If you’ve never asked your practice management software vendor for a SOC 2 report, that conversation is overdue.

You’re not expected to audit every vendor’s security program in detail. The carrier wants to see that you know who your top vendors are, what data they hold, and that you’ve asked the basic questions like SOC 2 attestation. An honest “we’ve identified our top five vendors and requested SOC 2 reports from three, with two outstanding” reads better than a confident answer that falls apart in discovery.

The mistake to avoid: misrepresentation and rescission

The most expensive answer on a cyber insurance application is the one that overstates the security controls you have in place. Cyber insurance applications are warranty documents. If a forensic investigation after a claim finds your environment didn’t match what you declared, the carrier can rescind the policy.

Rescission means the policy is treated as if it never existed, your claim is denied, and any prior payouts under the same policy term can be clawed back. Some courts have found that the carrier doesn’t need to prove a direct link between the misrepresentation and the loss. The misrepresentation itself is enough.

The cleanup approach is direct. If a question asks about MFA on all admin accounts and you have a gap, declare the gap and include a remediation date. Carriers reward honest gaps with a plan more than they reward polished answers that don’t survive forensic review.

Checking “no” or “in progress” on the form may raise your premium or tighten your coverage terms. That cost is predictable. Misrepresentation discovered after a claim can void the policy entirely, and the timing means you absorb the full incident cost yourself.

The 30-day pre-renewal checklist

Work through this in order. Most items are achievable in a month if you start now.

Week 1. Confirm MFA on email, VPN, remote desktop, all administrator accounts, and any service accounts that support it. Move admin MFA off SMS to an authenticator app or hardware token.

Weeks 1 to 2. Verify your backups are immutable or air-gapped. Run a test restore, and document the result with date and screenshots.

Week 2. Write a one-page wire transfer policy requiring callback verification to a previously verified phone number for any transfer over your chosen threshold. Get it signed by anyone who can authorize payments.

Weeks 2 to 3. Confirm EDR is deployed on every endpoint and server. If you only have traditional antivirus, get quotes for EDR or MDR now so you can answer with a deployment timeline.

Week 3. Identify your top five software vendors and request SOC 2 reports or equivalent attestations. Note who responded.

Weeks 3 to 4. Document or update your incident response plan, then run a 60-minute tabletop exercise with your leadership team. Keep the notes. That’s your “tested in the past 12 months” evidence.

Week 4. Sit down with the application and answer honestly. Flag anything you couldn’t fix, with a specific remediation date.

Frequently asked questions

What does rescission mean on a cyber insurance policy?

Rescission means the carrier voids the policy from inception after discovering material misrepresentation on the application. The policy is treated as if it never existed, the current claim is denied, and any prior payouts under the same policy term can be clawed back.

Will my cyber insurance be denied if I don’t have MFA on everything?

Not always denied outright. Expect a significant premium increase, sub-limits on ransomware coverage, or exclusions for incidents that trace back to the unprotected entry point. The most common gap is MFA on privileged or service accounts.

What is the difference between EDR and MDR on an insurance application?

EDR (Endpoint Detection and Response) is the technology that watches device behavior and flags suspicious activity. MDR (Managed Detection and Response) is the same technology plus a 24/7 team watching the alerts and responding. Carriers increasingly want both, and the application often asks about each separately.

Why are cyber insurance renewal applications longer than they used to be?

Carriers added detailed sections in response to specific 2023 and 2024 losses, including the MOVEit supply-chain breach, the Change Healthcare ransomware incident, and the Arup deepfake wire fraud. Each event drove changes to backup, MFA, vendor risk, or wire transfer questions on subsequent applications.

Can my cyber insurance claim be denied if I answered the application incorrectly?

Yes. Material misrepresentation on a cyber insurance application can trigger rescission, which voids coverage retroactively. Many courts have found that the carrier does not need to prove a causal link between the misrepresentation and the specific loss.

What does immutable backup mean on a cyber insurance application?

A backup that cannot be modified or deleted for a defined retention period, even by someone using stolen administrator credentials. Cloud object lock and write-once-read-many storage are common implementations. Most carriers want a window of at least 14 days, with 30 days now preferred.

Sources and further reading

If you have a cyber insurance renewal coming up and the gap between where your controls are and where the form wants them to be feels wider than 30 days, your IT provider should be able to walk through the application with you and identify what’s fixable in the time you have. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Free Business professionals completing a successful deal with a handshake in a modern office setting. Stock Photo
Posted on By Author colo1 Categories IT Management

Why Bad Onboarding Is the Real Cause of Messy Offboarding

By the time an employee hands in their notice, the decisions that will make their departure clean or messy have already been made. They were made in the first weeks of the person’s tenure, when nobody was paying close attention because the new hire had just arrived and there were a hundred other things to do. A shared login here, a quick SaaS sign-up there, a personal laptop used until the company hardware arrived. By month six, none of those feel like decisions at all. They feel like how things are.

This post covers what’s really going wrong when offboarding takes three weeks, the four onboarding shortcuts that guarantee a painful exit, how to retrofit hygiene on the team you already have, and what your IT provider should be doing at onboarding that probably isn’t happening.

What’s really going wrong when offboarding takes three weeks

A clean offboarding takes about 90 minutes of IT time. An account is disabled in your identity provider, which cascades access revocation across every tool connected via single sign-on. The device is remotely wiped or collected and wiped on-site. Email is forwarded to a manager or converted to a shared mailbox. The departing person’s accounts in your CRM and project tools are reassigned. A handover note, already templated because it was templated at onboarding, gets filled in and filed.

The messy version of the same process can take three weeks. It starts with a manual list of tools nobody can fully remember, which usually means asking the departing employee to help reconstruct it. You find a Figma account, a Loom workspace, a Notion instance, and an Airtable base, all set up independently, all with passwords sitting in the departing employee’s personal password manager. The laptop is at their house and they’re not in any rush. A client emails to say they received a strange message from a personal address. Six weeks later, a vendor charges the company card for a seat you thought you cancelled.

Whether your offboarding is clean or chaotic depends on what was set up during onboarding.

In the identity management world, this is called the “joiner, mover, leaver” lifecycle. Microsoft and most identity vendors use the same three-phase model. A rushed joiner phase compresses months of identity cleanup into the two weeks after the resignation lands.

Four onboarding shortcuts that guarantee a messy exit

Letting new hires sign up for SaaS tools on their own

When a staff member signs up for a tool independently, using their work email and a password only they know, that account is functionally theirs. You can’t reset it without triggering a notification to them. You may not even know the account exists until a vendor invoice shows up, or until the account goes dark after they leave and a client project breaks.

This is the most common source of the “we can’t find half the logins when someone leaves” problem. The fix is provisioning every tool through a central identity system, where any new SaaS application gets connected to your single sign-on before the first user logs in.

Tolerating personal devices “just until we get them sorted”

Personal devices that get used for work don’t stay temporary. The employee installs apps, connects to client systems, downloads files, and what was a temporary fix becomes how they work permanently. When they leave, you have no ability to wipe company data from a device you don’t own and never enrolled in a management system. You’re relying on their goodwill, which is usually fine, but it is not a security control.

The fix is to issue company-owned devices on day one and enroll them in mobile device management. When you do allow a personal device, require managed app access for company email and files. Browser-saved credentials are not a substitute.

Shared logins for tools you didn’t want to pay per-seat for

Shared credentials are the worst offender at offboarding. When five people use the same login for a tool, you can’t remove one person’s access without changing the password for everyone. You usually find this out at the worst possible time, when the person leaving is the one who set up the account and nobody else remembers the password at all.

Per-seat is the cost of doing this properly. The savings from shared logins reappear during offboarding as wasted hours and exposed access.

Letting client relationships live in one person’s inbox

This one is specific to agencies and professional services. When a senior account manager or consultant leaves, their client relationships often leave with them. The context, the email history, the preferences, and the half-finished threads lived in one person’s inbox. With the person gone, all of that becomes inaccessible or awkward to retrieve.

From the client’s side, your business just doesn’t know who they are anymore.

The fix is a shared inbox or CRM where client communication is logged. Even a Microsoft 365 shared mailbox with a clear expectation that client threads are CC’d to it is a meaningful improvement over what most small businesses have today.

How to retrofit hygiene on the team you already have

The cleanup most businesses need is for the team they already have, before the next hire arrives. You can’t go back and re-onboard your existing staff, but you can audit what’s there and close the gaps before the next departure.

The SaaS audit

Pull three months of credit card statements (every card that gets used for business expenses) and list every recurring SaaS charge. For each one, find out who set it up, who has the login, whether the account uses a personal or company email, and whether anyone else can access it if that person left tomorrow.

You’ll find tools nobody remembers signing up for, tools used by one person with no backup access, and accounts where the original owner has already left while you’re still paying for the seat. None of this is a technical exercise. All it takes is a spreadsheet and an afternoon.

The device register

Build a simple list: who has what, when each device was issued, whether it’s enrolled in a management system, and what company data each device can access. If you don’t have one, build it now. Ask every staff member to confirm the devices they use for work, including personal ones. The goal is to map what you’re working with. Most employees are happy to confirm what device they use once they know nothing punitive will come of it.

For any personal device that has been used to access company systems, the minimum is making sure company email and file access happens through managed apps that can be remotely disconnected.

Client communication in shared places

Move client communication into shared places so the relationship belongs to the business when an individual moves on. Continuity is the goal. Set up a shared inbox or alias for client-facing communication, and use a CRM where contact history and notes are logged. Even a shared Microsoft 365 mailbox with a clear expectation that client threads are CC’d to it is a meaningful improvement over what most small businesses do today.

What your IT provider should be doing at onboarding

Most IT providers get called when someone resigns. They show up, disable the account, collect the laptop if they can find it, and do their best with whatever documentation exists. That’s the wrong end of the lifecycle to be involved in. If that’s the only time your IT provider is involved in staff transitions, you’re not getting much value from the relationship.

The model that works puts your IT provider at onboarding too. They set up the new account in your identity provider, enroll the device in your mobile device management system, and provision access through single sign-on so every tool the new hire uses is connected to a central identity that can be switched off in one action. They should also maintain a handover document for each staff member, updated periodically, listing every system the person accesses, every client relationship they own, and every credential tied to their identity.

When that’s in place, offboarding becomes a checklist and an hour rather than a three-week excavation. Ask your IT provider what they do at onboarding. If the answer is “not much” or “we usually just get called when someone leaves,” that’s worth a conversation.

A 60-day plan before your next round of departures

You don’t need to know the exact date of the next resignation to start. The work is more manageable when nothing is urgent.

Weeks 1 and 2: Run the credit card SaaS audit. Build a list of every tool, every account owner, and every login that only one person controls. Flag the ones where access would be lost or complicated if that person left this week.

Weeks 3 and 4: Build the device register. Confirm what every staff member uses for work. For personal devices with company access, implement managed app access at minimum. Enroll company-owned devices in a management system if they aren’t already.

Weeks 5 and 6: Audit client-facing communication. Identify any client relationships that exist primarily in one person’s inbox or on someone’s mobile phone. Set up shared mailboxes or CRM logging for the highest-risk accounts first.

Weeks 7 and 8: Write the onboarding process you wish you’d had. Use everything you found in the previous six weeks as the input. Apply it to your next hire from day one, and use it as the template for a handover document for every existing staff member.

Most of this is an operational task rather than a technology project. A spreadsheet, some honest conversations with your team, and a few hours of your IT provider’s time will cover the bulk of it.

Frequently asked questions

How long should offboarding take in a small business?

With proper onboarding hygiene and centralized identity, the IT side of offboarding takes about 60 to 90 minutes. Take that foundation away and the same task can stretch to two or three weeks of scattered cleanup.

How do I find SaaS tools my team signed up for without telling me?

The fastest way is a three-month review of every credit card statement used for business expenses. Most shadow SaaS shows up as a recurring charge somewhere on the card.

Can I wipe a personal device after someone leaves?

Only the company data, and only if you set that up while they were still employed. Mobile device management or managed app access lets you remove company email, files, and credentials from a personal device without touching the rest of it. If those tools weren’t in place during their employment, your options are limited.

What’s the role of single sign-on in offboarding?

Single sign-on means every tool a user accesses is tied to a central identity. Disabling that identity in one place revokes access everywhere. Without single sign-on, you have to manually log into each platform and remove the user.

Should I make my employees use only company devices?

Where practical, yes. For personal devices, enrolling them in a management system or requiring managed app access is the next best thing. A personal device with saved company credentials and no management is the highest-risk configuration for offboarding.

Sources and further reading

If your offboarding process feels harder than it should be, that’s a good signal that your onboarding needs attention. Your IT provider should be able to walk you through both ends of the lifecycle and help you tighten what’s loose. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

a blue background with four different colored squares
Posted on By Author colo1 Categories New Technology

How to Prepare Microsoft 365 Permissions for a Safe Copilot Rollout

A safe Microsoft Copilot rollout starts with a permissions audit before any trial license is enabled. Microsoft 365 Copilot retrieves files, emails, and chats using each user’s existing Microsoft 365 permissions. In most tenants, those permissions are broader than anyone has mapped, because access tends to accumulate across years of projects, ad-hoc sharing, and staff changes. Microsoft itself now recommends a specific cleanup before any trial: map who currently has access to what, fix the permissions that have drifted out of scope, and apply sensitivity labels to confidential content.

This post covers what Microsoft 365 Copilot does with permissions, where oversharing tends to show up in a typical tenant, the kinds of content Copilot can return when permissions are broad, how to run the audit Microsoft recommends, and what to fix before any rollout.

How Microsoft 365 Copilot accesses your data

Copilot answers questions and generates content by retrieving information through Microsoft Graph, which is the API layer that ties together your Microsoft 365 services. When a user asks Copilot a question, it pulls from emails, calendar items, SharePoint documents, OneDrive files, Teams messages, and meeting transcripts that the signed-in user has permission to access.

The critical phrase in Microsoft’s own documentation is short: Copilot can only summarize or reference content that the user is authorized to access.

That statement is accurate, and it is also where the risk sits. The variable is whether each user’s permission set still matches what you assume it covers.

Why permissions tend to be broader than anyone thinks

For a manufacturer or trades business, most of the data sitting in your Microsoft 365 tenant is operational. Inventory records, production schedules, supplier contracts, project files. Some of it is sensitive, but the consequences are usually contained when the wrong employee reads a document.

At a professional services firm, the dynamic is different. The files are the product itself. Client matters, settlement figures, fee arrangements, deal terms, financial data, and employment records make up the deliverable, and the confidentiality of that material is the whole business model. Yet the same files often live in environments that were never properly scoped.

The reason is structural. “Just give them access for the Henderson matter” is how it starts. The matter closes, the access is never removed, and eighteen months later that person has read permissions on a folder they have no current reason to be in. Multiply that across five years of staff changes, project onboarding, ad-hoc Teams channels, and external sharing links that never expired. The result is a permission environment that nobody fully understands.

If the permission exists, Copilot can use it. Whether it was granted with appropriate scope is not part of the calculation.

Microsoft now acknowledges this directly. The company publishes a deployment blueprint for Copilot rollouts that organizes the work around three pillars: remediate oversharing, set up guardrails, and meet AI regulatory requirements. Microsoft’s own guidance puts oversharing remediation first, because it’s the pillar that has to be addressed before any rollout produces a useful result.

What Copilot can return in a tenant with broad permissions

Five examples of what Copilot can return when broad permissions exist and have not been audited:

“What is everyone’s salary?” Returns the compensation spreadsheet HR shared with a hiring manager during a recruitment process eighteen months earlier. The file remained shared after the hiring manager got promoted.

“Summarize the [client] case.” Pulls content from a SharePoint site set up for a different team. A user added during a one-off project two years ago still has the permission that was never removed, and Copilot returns a summary of the case to them.

“What deals are we currently working on?” Aggregates content from M&A data rooms that were never properly closed, pipeline trackers in personal OneDrives that got shared once for a partner meeting, and prospect lists sitting in a Teams channel that grew beyond its original membership. The output is a single consolidated view of the firm’s commercial pipeline.

“Find everything mentioning [former employee].” Surfaces the termination memo, the severance calculation, the performance review that preceded the exit, and any email threads saved to SharePoint. Material that was never intended to be findable below partner level shows up in one query.

“What’s our markup on [client] engagements?” Outputs the internal pricing sheet that was shared during a proposal process so two people could review it. The link was never restricted, the file was never moved, and the numbers come back when Copilot is asked.

The question of who would ask any of these queries is separate from the question of what Copilot can return. Microsoft’s deployment guidance focuses on what Copilot is capable of returning, and recommends a permissions review before Copilot is enabled at any scale.

Why a “small pilot” is rarely as contained as people think

Running a limited pilot feels like a safe middle ground, but the way most firms set them up tends to produce the highest-risk version of the trial.

The three or four people picked for a pilot are almost always senior. Senior staff have the broadest access of anyone in the firm, which means any searches they run have the widest possible scope. A pilot with three senior partners produces a higher-risk preview of Copilot than a pilot with three junior staff.

And pilots drift. Licenses get reassigned when a partner decides they are not using one. The person who ends up with the license is often whoever asked most recently, which is not the same as whoever has the most appropriate access profile.

Microsoft’s audit logs will show you what was asked after the fact, but the asking cannot be reversed. Once a Copilot summary has been returned to a user, that information cannot be recalled.

The cleanup that should happen before any trial

Before you click “start trial,” four pieces of work make the difference between a useful test and a disclosure event.

SharePoint sharing audit. SharePoint Advanced Management includes a content management assessment that surfaces permission issues, oversharing patterns, and inactive sites. If your tenant has never been reviewed, this is the first place to look. The report identifies which sites are shared more broadly than they should be.

OneDrive external share review. Look at files shared outside the organization that were never recalled. These are particularly common in legal and accounting firms where files get sent to clients for review and then forgotten.

Teams membership review. Confirm that channel membership still reflects who should have access to the files stored there. Channels that grew during an active project and were never trimmed are a frequent source of unintended access.

Sensitivity labels for confidential content. Microsoft Purview sensitivity labels are the mechanism that tells Microsoft 365 which content is confidential. Once applied, you can use Data Loss Prevention policies to exclude labeled items from Copilot processing, and use encryption settings that block Copilot from reading the content at all without explicit permission. Without sensitivity labels in place, Copilot has no way to treat a client settlement document differently from a catering invoice.

These four pieces of work generally take four to eight weeks for a firm in the 25-to-100-person range. Some of it can be done by your IT provider. The most sensitive parts, like deciding which document categories deserve which sensitivity label, are best handled with input from the partners or owners who understand the material.

The one question to send your IT provider

Before you make any decision about Copilot, send this to whoever manages your Microsoft 365 environment:

“Can you show me a report of every file in our tenant that’s accessible to more than ten people, and flag the ones containing client names, salary figures, or financial data?”

If they can produce something useful within a few days, your environment has been managed actively. The report will not be a perfect audit, but it will show you the shape of the problem and give you a starting point.

If the answer is “we’d need to enable some things first,” that itself is informative. It means the SharePoint sharing reports have never been run and the tenant has never been reviewed from a permissions perspective. That’s the real answer to your Copilot readiness question, and the audit needs to happen before any trial does.

Frequently asked questions

Does Microsoft 365 Copilot have access to my files by default?

Copilot has access to whatever the signed-in user has access to, scoped by Microsoft Graph and existing SharePoint, OneDrive, and Exchange permissions. Copilot cannot reach files outside the user’s existing permission set.

Can sensitivity labels stop Copilot from reading certain files?

Yes. Microsoft Purview sensitivity labels with encryption can block Copilot from reading the content. Files require the user to have specific usage rights (EXTRACT and VIEW) for Copilot to interact with them. Data Loss Prevention policies can also exclude labeled items from Copilot processing.

Is a small Copilot pilot a safe way to test it?

A pilot is fine if the pilot users have limited access to sensitive content. The common mistake is running a pilot with senior staff, who tend to have the broadest access in the firm.

How long does it take to prepare a tenant for Copilot?

For a firm with several years of accumulated content, the preparation usually takes four to eight weeks. The work involves a SharePoint sharing audit, an external share review, a Teams membership review, and sensitivity label application.

What does Microsoft say about Copilot oversharing risk?

Microsoft publishes a deployment blueprint that organizes Copilot security work around three pillars: remediating oversharing, setting up guardrails, and meeting AI regulatory requirements. The oversharing pillar is the one that should be addressed before any Copilot trial.

Sources and further reading

If you have not reviewed your Microsoft 365 tenant in a while, that review is worth doing whether or not Copilot is on your roadmap. Your IT provider should be able to run the SharePoint sharing report and walk you through what it shows. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

1 2 3 … 33