“What do I do if…” — situations that arrive without warning, and where to begin with each. You will find the first steps to take, the reasoning behind it, and a candid assessment of how concerned you should realistically be.
Not to alarm you into a phone call. Where we think a risk is overstated, we say so.
Growing an organization and protecting it are the same discipline. Both are covered here.
Built from situations people bring to us. Send us yours and we will add it.
If something is happening right now — money is moving, or systems are locked — filter to “Happening now” below, then telephone someone before you act. Involving a second person is the most underrated control available, and it costs nothing.
This page provides general education, drawn from our own experience and from published research. It is not advice concerning your particular circumstances, your systems, your contracts or your legal obligations, and it cannot be, since we have visibility into none of those.
Treat each scenario as a starting point for your own research rather than as an instruction. Verify anything consequential independently, and where money, data, personnel or regulators are involved, obtain qualified professional advice before acting. You proceed at your own risk, and responsibility for the outcome remains with you.
Circumstances differ in ways that change the correct answer entirely. A course of action that suits a sole proprietor may be wrong for a regulated practice carrying an insurance policy and a statutory notification duty.
Ordered roughly by how fast you need to move. The red ones are where minutes matter.
1. Disconnect from the network, but do not power anything off. Unplug the network cable and disable Wi-Fi, then leave the machines running. Shutting down destroys evidence investigators will need, and some variants cause further damage on reboot.
2. Photograph the ransom screen using your phone. Capture the note itself, any reference or identifier it displays, and the altered file extensions. You will need all of it.
3. Contact your cyber-insurance provider before anyone else. Most policies require you to engage their approved incident responders. Bringing in your own IT firm first can invalidate the claim entirely.
4. Do not pay, and do not decide alone. Not yet, and certainly not within the first hour.
The instinct is to resolve the situation quickly and quietly. Almost every expensive error in a ransomware incident originates in that instinct: powering machines down, wiping and rebuilding, paying early, or engaging a responder the insurer has not approved.
The insurance point is the one that catches organizations out most often. Cyber policies generally name a panel of firms you are required to use. Organizations routinely do the apparently sensible thing, call their usual IT support, and discover weeks later that the claim will not be paid.
We will not tell you never to pay. That decision belongs to you and your counsel, and some organizations genuinely have no other route to survival. What we will tell you is what payment does not achieve: it does not un-steal the data, it does not remove your notification obligations, and decryption tools supplied by attackers are frequently slow and incomplete.
1. Do not act on the request, even partially. Preparatory steps such as drafting the transfer or assembling the paperwork feel harmless, but each one commits you a little further.
2. Hang up and call back on a number you already hold. Use the details in your own records, never a number offered during the call or supplied in a follow-up email.
3. If you cannot reach them, bring in a colleague before going further. Authorization is not the point. A second person interrupts the pressure the caller depends on, since every version of this attack needs you alone with the decision.
Cloning a voice now requires only a few seconds of source audio, rarely difficult to obtain: a podcast appearance, a recorded talk, a voicemail greeting, a video on your own website. The tools are cheap, fast, and no longer distinguishable by ear. Recognizing a voice has stopped functioning as verification.
The audio is not the attack itself. Urgency, authority and secrecy are. Requests of this kind arrive time-critical, come from someone you would hesitate to challenge, and often carry a confidentiality wrapper — an unannounced transaction, or a matter the wider team must not learn about. The wrapper exists solely to discourage you from checking.
Agree a verification habit now, while nothing is happening. Two measures, both free:
One point deserves saying out loud to your team: nobody should ever face criticism for slowing a payment down to check it. A culture penalizing hesitation builds the vulnerability in-house.
Do not pay it, and do not reply to it. A reply confirms that a person is reading, and it reaches the sender rather than your supplier.
Telephone your supplier on the number you held before this email arrived — from your own records, an earlier invoice, or their website reached by your own navigation. Never the number printed on the new invoice.
Ask one specific question: have your banking details changed? The answer is almost always no, and in most cases your supplier has no idea this is happening.
Because it generally is genuine. In most cases this is a real invoice. Either your supplier’s mailbox has been compromised and someone is monitoring the thread, or a legitimate invoice was intercepted, the banking details altered, and the document resent from a near-identical address.
This is why conventional advice fails here. The logo is correct, the amount is correct, the reference matches genuine work, and the tone is right because earlier correspondence was available to copy. The only incorrect detail is the one that moves the money.
Examine the domain closely. A single letter transposed, a hyphen inserted, .co in place of .ca, or rn standing in for an m. On a phone screen, under time pressure, these are effectively invisible, which is precisely the intention.
Every change to banking details is verified by telephone, on a known number, without exception. No allowances for long-standing suppliers, for urgency, or for a plausible explanation about changing banks. Write the rule down, give it to whoever processes invoices, and make it entirely routine.
Do not open the attachment, and do not click anything within it. The invoice may not be the objective; frequently the attachment is.
Confirm that nobody in your organization placed an order before concluding it is fraudulent. If no one did, delete it, or report it to your IT provider if you have one.
Malware delivery. The attachment is the payload and the invoice merely supplies a reason to open it. Anything prompting you to “enable content” or “enable macros” falls into this category without exception.
Or straightforward opportunism. Plausible invoices for modest sums, sent in volume, on the expectation that a busy finance team will pay without checking. Domain renewals, directory listings and office supplies are the standard pretexts, and the amounts are deliberately kept low enough to avoid scrutiny.
Treat it as a possible infection rather than an inconvenience. Disconnect that machine from the network and have it examined before it is reconnected.
1. Do not click the link. Not to inspect it, and not to “cancel the request”. If the email is fraudulent, the button is the entire attack.
2. Go to the service directly, typing the address yourself or using your own bookmark, then sign in as normal. Any genuine problem will be visible there.
3. While signed in, change the password and review which devices have access. If the reset request was real, someone has your address and is actively attempting entry.
The more common case. The message is a lure, the link leads to a convincing replica of the login page, and entering your password there hands it over directly. Read the domain following the @ rather than the display name, and disregard the padlock on the fraudulent site: certificates are free and prove nothing about intent.
This possibility gets dismissed as spam far too readily. A legitimate reset email you did not request means someone entered your address on the login page and selected “forgot password”. Nothing has succeeded yet. An attack is in progress, and you are being notified of it.
Where the messages continue arriving, treat the pattern as targeting rather than noise.
1. Provide nothing. No passwords, no card numbers, no verification codes. A legitimate assistant requires none of these, neither to “confirm your identity” nor to “continue”.
2. Do not follow links it produces, and do not run any command or script it asks you to run.
3. Begin an entirely new conversation. Do not continue the existing one, since whatever is directing the behaviour resides within that thread.
In most cases the cause is prompt injection. Instructions are concealed inside content the assistant reads on your behalf: a web page it browsed, a document you uploaded, an email it summarized. The assistant cannot reliably separate your instructions from instructions buried in the material, so it follows both.
The behaviour change is therefore often sudden and tied to a specific moment, immediately after the assistant opened a link, read a file or processed a message. The hidden text may be invisible to you, rendered white on white or placed in metadata.
Establish what the assistant was connected to. Where it holds access to your email, files or calendar through an integration, the exposure extends well beyond an unusual conversation. Review connected applications and revoke anything you do not actively require.
Review what you pasted earlier in the thread. If client data, credentials or confidential material went in before the behaviour changed, treat it as potentially disclosed and respond accordingly.
Then report the incident to the vendor. These problems get fixed because people report them.
1. If the cursor is moving while you watch, disconnect from the network immediately. Unplug the network cable or switch off Wi-Fi. This is the one situation where speed matters more than preserving evidence, because someone may be operating the machine in real time.
2. Do not power the machine off, and do not start closing things. Leave it running once it is off the network. Shutting down destroys the record of what was happening.
3. Record it on your phone. A cursor moving by itself is one of the few incidents you can actually capture, and it will matter enormously to whoever investigates.
4. Telephone your IT provider on a number you already hold and ask one question: is anybody connected to this machine right now? Most of the time the answer is yes, and the whole thing resolves in under a minute.
Most of the time this is benign, and we are not going to pretend otherwise. Remote support sessions, overnight patching, a wireless mouse on a glossy desk, a laptop trackpad catching a sleeve. Scheduled tasks and software updaters open and close console windows constantly, and on a managed machine that happens several times a day.
Which is precisely the difficulty. These events are common enough that people learn to ignore them — so the one occasion it is not routine gets ignored along with all the others.
Stop trying to judge whether the behaviour looks suspicious, because legitimate remote support and a hostile operator produce identical symptoms. The cursor moves the same way either way.
Ask instead whether anyone will take responsibility for it. Authorized work is announced, ticketed and attributable — a person can confirm it on the phone. Unauthorized access is the same behaviour with nobody owning it. Attribution is the test, not appearance.
A console window appearing for a fraction of a second is usually a scheduled task, a login script, a software updater or policy processing. Benign by a wide margin.
The thing worth noticing is timing. A flash at login or on the hour is almost certainly housekeeping. A flash immediately after you opened a document, clicked a link or connected a device is a different matter, because a brief console window is exactly what a script running once looks like.
Autorun has been disabled by default on Windows for many years, so the classic “plug it in and it infects you” is largely historical. The replacement is worse and less known: devices built to look like a memory stick while identifying themselves to the computer as a keyboard, then typing commands faster than you can read. Nothing warns you, because as far as the machine is concerned a person is typing. That produces exactly these symptoms. See the car park USB scenario above.
Someone noticed a cursor move and asked. That instinct is worth more than any product you could buy, and it survives only in an organization where asking is free.
Tell your staff plainly: nobody will ever be made to feel foolish for reporting something odd, including when it turns out to be nothing. The alternative is a team that stays quiet for a week, and a week is a very long time.
1. Assume the caller ID is wrong. The number displayed on your phone is supplied by whoever placed the call, and it can be set to anything. Your bank’s real number appearing on screen proves nothing whatsoever.
2. End the call and dial back on a number you obtained yourself — from the back of your bank card, a previous invoice, or the organization’s website reached by your own navigation. Wait a few seconds before dialling, or use a different phone, since a held line can be kept open.
3. Give out nothing in the meantime. No passwords, no verification codes, no card details, and no remote-access session. A genuine institution will wait while you call back. Anyone who objects to you verifying has told you what they are.
You cannot reliably authenticate an inbound call. Caller ID is forgeable, voices can be cloned from seconds of audio, and the caller may know your address, your recent transactions and the name of your account manager, because that information leaks constantly through breaches.
Stop trying to detect fraud and change the direction of the call instead. Verification works when you initiate contact through a channel you selected. Every other test can be defeated.
Urgency exists to prevent verification. Fraud on your account, a compromised server, a payment failing within the hour: each pretext creates a reason to act before checking. Treat urgency itself as the signal, independently of how plausible the story sounds.
Give every member of staff explicit permission to hang up. Most people comply with an authoritative caller because refusing feels rude, and fraud relies on that politeness far more than on technical skill. A stated policy removes the social cost of ending the call.
Agree one line everyone can use: “I will call you back on our published number.” Nobody needs to accuse anyone of anything, and the fraudulent call ends immediately.
1. Approve nothing you did not personally start. An unexpected Microsoft or Google sign-in prompt means someone is attempting to enter your account at that moment, holding a password which works. Approving it grants them access.
2. If prompts keep arriving, change that password immediately and sign out of all sessions. Repeated requests indicate someone persisting until you tap approve out of irritation, a technique known as MFA fatigue.
3. Do not scan unexpected QR codes, and do not follow links arriving by text. Open the service directly instead.
Phishing by text succeeds because phones compress everything. Links are shortened, the sender is a bare number, and people read messages while walking. A delivery notice, a toll charge, a tax refund, a message from the boss who has “lost their phone” — all low-effort, all effective at volume.
A QR code conceals its destination completely, which is the entire problem. You cannot inspect the domain before committing, and phones often open the page without an intermediate confirmation. Printed codes placed over genuine ones in car parks, on parking meters and on restaurant tables are now a documented pattern.
Treat a QR code in an email as a straightforward red flag. Legitimate senders who already have your email address have no reason to route you through a camera.
The most serious of the three, because it confirms your password is already compromised. Multi-factor authentication is doing precisely its job at that moment, and the attacker is waiting for you to undo it.
Where available, switch to number matching or a passkey. Number matching requires you to type a digit shown on screen, which cannot be satisfied by a reflexive tap. Passkeys remove the approval step altogether.
Not “does it still work”, but “does it still receive security updates”. Those are entirely different questions, and only the second one carries risk. A ten-year-old machine running a supported operating system is far safer than a four-year-old machine running one the vendor has retired.
Check the end-of-support date for each operating system you run, then list which machines are already past it and which pass within the next twelve months. The exercise takes an afternoon and usually produces one genuine surprise.
The machine behaves exactly as it did the previous day. What stops is the supply of security patches. From that point every newly discovered flaw remains permanently open, and those flaws are published in public databases that attackers read as a shopping list.
An unsupported system therefore does not degrade gradually. It accumulates known, documented, unfixable weaknesses, and the gap widens every month it stays in service.
Start with whatever faces the internet, because an exposed device can be reached by anyone without requiring a mistake from your staff. Replace the router or firewall first, regardless of how well it appears to run.
Then take the machines holding sensitive data. Client records, patient information, payroll, financial systems.
Everything else can wait, and often should. A machine with no network access and no sensitive data on it is a genuinely low priority. Replacing hardware that works is a real cost, and we are not going to pretend otherwise.
Reduce what the device can reach. Take it off the main network, remove its internet access, revoke its access to shared drives, and limit it to the single task requiring it. Isolation is a legitimate control, not a compromise, and for small organizations it is frequently the correct answer.
It is necessary and no longer sufficient, and the reason is worth understanding. Traditional antivirus compares files against a list of known-bad signatures. It is excellent at catching threats somebody has already catalogued, and blind to anything assembled this morning.
The attacks that matter to small organizations mostly involve no malicious file at all. Someone signs in with a working password, creates a mail rule, and sends an invoice. No antivirus product was ever designed to see that, because nothing malicious was downloaded.
Detection without response is an alarm in an empty building. Most small organizations that buy EDR never configure anyone to answer it, and alerts arrive at 3am into a mailbox nobody opens until Monday. If nobody will respond, MDR is the honest purchase, and if MDR is unaffordable, say so and plan around it rather than buying the alarm alone.
Several measures reduce risk further than an endpoint product and cost nothing: multi-factor authentication everywhere, removing administrator rights from daily accounts, a tested backup, and a rule governing changes to banking details. An organization without those should fix them before buying detection software, because detection assumes an attacker who got in, and those four reduce how often one does.
Most organizations cannot answer this, and the inability is itself the finding. You cannot patch, protect or remotely wipe equipment nobody has recorded, so every unknown device is by definition an unmanaged one.
Start from accounts rather than hardware. Open your Microsoft 365 or Google Workspace admin console and review the sign-in and device lists for each user. Mail accounts reveal phones nobody registered, and the exercise usually surfaces several devices the organization did not know existed.
A spreadsheet is entirely adequate. Device, who holds it, operating system and version, whether updates install automatically, and what organizational data it can reach. The final column is the one carrying value, since a phone holding only calendar access presents a different problem from a laptop with the shared drive mapped.
Review it when someone joins and when someone leaves. Those two moments account for most of the drift.
Permitting staff to use their own phones is reasonable and widespread. The requirement is a documented position rather than a prohibition. Decide what personal devices may access, require a screen lock and current updates as a condition, and establish how access gets removed when someone leaves. Without a stated position, personal devices accumulate access silently and nobody can describe the exposure.
Anything facing the internet: days, not weeks. Firewalls, routers, VPN appliances and remote-access gateways. Exposed edge devices have become a leading route into organizations, and a flaw in one can be reached by anyone without a single mistake from your staff.
Everything else: enable automatic updates and stop deliberating. For organizations without a dedicated IT team, automatic updating outperforms any schedule a person will actually maintain.
Any organization running more than a handful of systems carries a backlog permanently. Treating every vulnerability as equally urgent guarantees paralysis, so the discipline lies in sequencing rather than completeness.
Severity scores alone are a poor guide. A critical-rated flaw nobody can exploit matters less than a moderate one being used against organizations this week.
Organizations postpone updates because an update once broke something important. The concern is legitimate, and the remedy is a staged rollout rather than indefinite deferral — update a small group first, confirm nothing breaks, then proceed.
Indefinite deferral converts a temporary risk into a permanent one. An unpatched system does not become safer as the months pass. Each publicly documented flaw remains open and available to anyone who looks.
Open the connected-applications list on your Microsoft 365 or Google Workspace tenant. Most organizations have never viewed it, and most find entries nobody recognizes. Each one represents a third party holding standing permission to read, and sometimes to send.
Review browser extensions separately, since they live on the device rather than in the account. An extension with permission to “read and change all your data on all websites” can observe every page a person opens, including the banking portal.
When someone connects an application to their work account, they grant it a token rather than a password. The distinction matters considerably.
A token survives a password change, and frequently survives multi-factor authentication as well. Revoking the password does nothing. The connected application continues reading mail and files until somebody explicitly withdraws the grant — which almost nobody thinks to do, because the breach being responded to concerned a password.
The consent screen arrives mid-task, worded vaguely, while the person is trying to finish something. “Read your contacts” and “Read, compose and send email on your behalf” appear in identical grey text, and nobody reads either. The scheduling tool, the signature generator, the PDF converter, the free analytics dashboard: all legitimate categories, all commonly over-permissioned.
Extensions change ownership. A useful tool acquires a small user base, gets sold, and the new owner pushes an update injecting advertisements or harvesting browsing data. The extension updates silently, and nobody is notified. The product you vetted and the product running today are not necessarily the same software.
Stop protecting a location and start protecting the identity. There is no office perimeter to defend when the work happens everywhere, so the account becomes the thing worth securing, not the network someone sits on.
In practice, three measures capture most of the benefit: phishing-resistant multi-factor authentication on every account, full-disk encryption on every device, and a documented way to revoke access remotely when a laptop disappears.
Worth stating plainly, because the advice persists well past its expiry. Nearly all web traffic is encrypted in transit now, so the classic coffee-shop interception attack has largely stopped working. A consumer VPN mainly relocates your trust from an internet provider to a VPN company, and the marketing around it considerably outruns the benefit.
A business VPN connecting staff to internal systems is a different matter and remains useful. The two get conflated constantly.
Require three things of any device touching organizational data: a screen lock, automatic updates enabled, and disk encryption switched on. All three are free, all three are verifiable, and together they address most of what actually goes wrong.
Keep work in the browser where practical. Data accessed through a browser session rather than downloaded locally reduces how much a lost device carries, and revocation becomes a single action in the admin console.
Write down what happens when a device is lost, before one is. Who to telephone, who revokes the sessions, who changes the passwords. Lost devices are discovered at inconvenient hours, which is precisely when nobody improvises well.
Dispose of it. Both items. Do not plug either in to identify the owner, not on a spare laptop, and not on a machine you consider unimportant.
If the item appeared somewhere it should not have — inside a locked office, on a reception desk, in a bag — report it before disposing of it. Placement of that kind raises a different question entirely.
Researchers have repeatedly scattered USB drives across car parks and measured how many were subsequently plugged into work machines. The technique continues to succeed, because curiosity is the exploit. Wanting to find the owner is a perfectly decent instinct, and the attack depends on it.
A hostile drive need not behave like a drive at all. Devices exist which are physically identical to a memory stick but identify themselves to the computer as a keyboard, then issue commands faster than anyone could read them. No warning appears, because the machine believes a person is typing.
Malicious cables are real and sold openly as penetration-testing equipment, with the electronics concealed inside the moulded connector. They are indistinguishable from an ordinary cable by sight or by weight.
We will be straightforward with you, however: we are aware of no documented cases of these being deployed against ordinary consumers. They remain a professional tool, and the odds of the mystery cable in your drawer being one are low.
One principle here is worth carrying well beyond this page:
When the safe choice costs you nothing, you need very little evidence to justify it. When the safe choice costs you money or attention, you need a great deal.
Discarding a cable you never owned costs nothing, which is why we offer the advice confidently despite thin evidence. By the same reasoning we tell you not to avoid airport charging points, since avoiding them carries a real cost against a threat nobody has documented.
The other half of the work. Same format throughout: the first step, the reasoning behind it, and a candid assessment of how difficult it genuinely is.
1. Confirm you applied through Goodstack. Google’s validation partner is Goodstack, formerly Percent — not TechSoup, despite a great deal of online guidance still saying otherwise. Beginning elsewhere can stall the entire application on its own.
2. Obtain the specific rejection reason in writing rather than working from a summary. “Not to spec” covers several quite different problems, each with a different remedy.
Resolve HTTPS first, since nothing else can be assessed without it. Next, make the homepage answer three questions directly: who you are, who you help, and what a visitor should do next. Then reapply.
Approval is the straightforward half. Retention is where charities lose the grant. A 5% click-through minimum, active conversion tracking, no single-word keywords, and an account requiring genuine management. A meaningful proportion of approved organizations lose the grant within a year to rules nobody explained to them.
Before celebrating approval, decide who will run the account. An unmanaged Ad Grant does not sit quietly idle; it gets suspended.
Before touching any code, define what counts as success. A booked call, a submitted form, a tapped phone number, a donation. You cannot measure a conversion you have not defined, and most tracking projects fail at this point rather than on anything technical.
Then install a single container rather than five separate snippets. Google Tag Manager places one piece of code on the site and holds everything else inside it.
A snippet or tag is a small piece of code supplied by a platform, pasted into your site so the platform can observe what visitors do. A conversion is your instruction to that platform about which action carried value. A container holds all of them, sparing you from pasting code each time.
Cookie consent. Where you serve visitors in regions with consent requirements, tags must respect the choice a visitor makes. Retrofitting consent afterwards is considerably more painful than planning for it.
Untested tracking. Broken conversion tracking is the most common root cause we find behind “our marketing does not work”. It is worse than having none, since it produces confident numbers which happen to be wrong.
In plain terms: you pay other people a commission on sales they send you. They promote, you pay only when a sale completes, and tracking links record who sent what.
An honest answer on timing: with the holiday season only weeks away, this is not your lever. Affiliate programs take months to recruit partners and build trust. Establish one now for next season, and use a faster channel for this one.
Affiliates must clearly disclose when a link is paid. In Canada this falls under the Competition Act’s provisions on misleading representations, and the Competition Bureau has grown increasingly active on undisclosed influencer and affiliate promotion. Enforcement can reach the brand as well as the affiliate, so write disclosure requirements into your terms and verify compliance rather than assuming it.
It works well for products carrying healthy margin and clear appeal, in categories with an established audience of reviewers or creators. It works poorly for services, for anything with a long or consultative sales cycle, and for thin-margin goods.
If you need revenue this holiday season, the faster levers are your existing email list, your Google Business Profile, and confirming the checkout genuinely works on a phone. Unglamorous, and they pay this month.
1. Do not open a second Google Ads account. This is the most damaging instinct available, and almost everyone has it. Creating a new account to circumvent a suspension is itself a policy violation, and it can convert a fixable problem into a permanent one.
2. Establish which kind of suspension you are facing. Sign in and read the notice at the top of the account. A policy suspension names the rule breached. An inactivity or program-compliance pause is a different matter with a different remedy.
3. Do not reapply or appeal before you have corrected something. A rejected appeal leaves you in a worse position than an unfiled one.
Correct the cause before touching the appeal. Remove the offending keywords, rebuild the ad groups around specific intent phrases, verify conversion tracking is firing, and set your geography properly. Then submit the reactivation request, stating plainly what was wrong and what you changed.
Expect the review to take time. Reviews are not instant, and chasing them does not accelerate the outcome.
Then address why it happened. A suspension nearly always indicates the account was never configured to program rules in the first place. Reinstating it without changing how it is managed buys a few months and no more.
You are right that you did not need one. Twenty years of business built on reputation and word of mouth is a genuine asset, and most companies with handsome websites would trade them for it. Nobody should suggest otherwise, and anyone opening with the implication you have been doing it wrong is selling rather than advising.
What changed is not websites, but what people do before they call you. They look you up first, to confirm you are real, still trading, and the same business someone has just recommended. Where there is nothing to find, a proportion of them stop there. You never hear from those people, which is precisely why the gap stays invisible.
Not a large build, and not a monthly retainer producing content nobody reads. For a great many established businesses, a properly completed Google Business Profile alongside one honest page — who you are, what you do, where, how to reach you, a few genuine photographs and a handful of real reviews — captures most of the available value. Anyone quoting a substantial project before asking what you actually want more of is guessing.
A poor site is worse than none. A neglected page carrying a dead telephone number, 2019 prices, or a contact form going nowhere actively costs you work. If you will not keep it current, keep it small enough to stay true.
Register your own domain name and move your email onto it, even if the site waits. The annual cost is small, the asset is yours, and it prevents someone else registering your business name later.
Real things people have said to us, close to word for word. Some are emergencies. Most are the quieter kind — a question someone carried around for a year because nobody gave them a straight answer, or one they are living with this week and have not said out loud yet.
Several of these sit across both halves of the job at once, and are labelled Grow + Protect. Those show up under either filter, because the problem genuinely does.
Hit a term you do not know? The glossary explains every word on this site in plain English — written on the assumption that nobody is born knowing this.
Start with what is true here, because most of it is. “Fine so far” is real evidence and it deserves respect — you have run a business for years without an incident, which plenty of far better-resourced organisations cannot claim. And Windows Defender is genuinely good now. Anyone who tells you it is worthless is selling something.
The gap is not that you were wrong. It is that “nothing has happened” and “we are not exposed” feel like the same sentence, and they are not. One is a record. The other is a forecast.
What changed is not that threats got cleverer. It is that they got automated and indiscriminate. Most attacks on small organisations are not aimed at you — nobody chose you. Scanners sweep the whole internet for a known weakness and take whatever answers. Being small used to mean being uninteresting. Automation removed that protection, because the cost of trying you fell to nearly nothing.
Defender handles the file-on-the-disk problem well. It does not cover the three things that actually cause bad weeks: someone signing in as you with a working password, a backup nobody tested, and an account you forgot to switch off. Those are not virus problems, so no antivirus was ever going to catch them.
Word of mouth built this. Keep it — but notice that it is a single channel you do not control, and its capacity is capped by how many people happen to know you. That is concentration risk in commercial clothing. It is the same shape of exposure as one customer being 60% of revenue, and it is fine right up until the week a key referrer retires.
That is most of the risk, and none of it is a project. If someone is quoting you a monthly retainer before they have asked whether your backup restores, they are selling a product rather than answering your question.
Mostly, no — and a great deal of what you are seeing is theatre. Plenty of businesses announce AI adoption and change almost nothing about how they work. Some are worse off, having added a tool nobody governs.
But two real things hide inside the question, and they pull in opposite directions: a genuine efficiency gain on repetitive work, and a visibility shift that is happening whether or not you adopt anything. Those deserve separate answers.
Narrow, boring, repetitive text work. First drafts, summarising a long document, turning notes into something sendable, rewriting the same reply for the hundredth time. The gain is real but unglamorous, and it is measured in hours rather than transformation.
Anything promising strategy, judgement, or replacing a person who knows your customers. And anything sold as an “AI platform” that is a normal product with a new label on the pricing page.
This is the part that has nothing to do with whether you adopt a tool. People increasingly ask an assistant for a recommendation instead of scrolling a results page, and those answers are assembled from sources the model can find, read and quote. If your business is thinly documented online, you are not losing that comparison — you were never a candidate in it.
So the defensive move is not buying AI. It is making sure clear, accurate, specific information about what you do exists somewhere machine-readable. That is closer to writing a good page than to adopting a platform.
Decide what must never be pasted in, and say so out loud, before anyone starts. Client records, anything covered by a confidentiality clause, payroll, credentials. The most common AI incident in small organisations is not a rogue model — it is a well-meaning employee pasting something sensitive into a personal account nobody knew existed.
1. Change the password and sign out every session. Changing the password alone is not enough — an attacker with an active session stays in. Look for “sign out everywhere” or “revoke sessions”.
2. Check for mail rules and forwarding you did not create. This is the step people skip, and it is the one that matters most. A rule quietly copying your mail outward, or filing anything containing “invoice” into a folder you never open, means they intended to stay. Remove them and note what they were.
3. Read the Sent and Deleted folders. What went out, and to whom? If anything asked a customer or supplier to change bank details, phone those people now — do not email them.
4. Check the recovery email and phone number on the account. Changing these is usually the first thing done once inside.
This is business email compromise, and it costs organisations more than ransomware does. There is no malware to find and nothing looks broken — someone simply signed in as you and read your mail until they understood how your money moves. Then they sent one message, from a real address, at a plausible moment.
That is why it defeats staff training. The email is genuine. It comes from the right person, continues a real thread, and uses the right vocabulary.
Assume anything in that mailbox was read. If it held client records, contracts, or personal information, you may have a notification obligation — that is a question for your lawyer and, if you carry it, your insurer. Tell the insurer early; policies often require prompt notice, and a delay can matter more than the incident.
Restore something this week. Not check the dashboard, not confirm the green tick — take one real file, or better a database, and bring it back. Time how long it takes and write the number down.
Until you have done that, you do not have a backup. You have a hypothesis. That is not a slogan — a meaningful share of the failed recoveries we hear about involve a backup that had been running, and reporting success, for months.
Get one copy out of reach. Offline, or immutable — meaning it cannot be altered or deleted for a set period even by someone holding valid credentials. This single property is what makes the difference between a bad week and an existential event.
Answer two questions in plain numbers. How much work can we afford to lose — an hour, a day? And how long can we be down before this becomes serious? Those two answers drive every other decision, and most organisations have never been asked them.
Then test on a schedule and keep the evidence. Quarterly is reasonable for most small organisations. Note what you restored, how long it took, and what broke. That record is also what an insurer or a board will ask for.
Cloud file sync is not a backup. It is a mirror, and it faithfully mirrors encryption and deletion. Versioning and recycle bins help, but they have limits and attackers know exactly what they are.
The honest answer is that most organisations do not know, and the number using these tools is higher than leadership thinks. This is called shadow AI, and the pattern is consistent: capable people solving real problems with a tool nobody told them not to use.
The exposure is rarely malice. It is a personal account — outside your tenant, outside your logging, with settings and retention you do not control and cannot audit.
Whatever someone was already struggling to write. Contracts being summarised. Client emails being softened. Spreadsheets pasted wholesale to ask what a pattern means. Source code. Draft board papers. Almost always the thing that was hardest to do, which is usually the thing that was most sensitive.
A ban moves the activity onto phones and personal laptops, where you have no visibility at all. You trade a manageable problem for an invisible one, and you lose the ability to help people do it safely.
AI features are arriving switched on inside tools you already pay for — note-takers joining meetings, assistants summarising mailboxes, features added in an update nobody read. So “we do not use AI” is frequently untrue by the time it is said. Worth checking what is enabled by default across your existing subscriptions.
This is almost never a marketing problem. It is a measurement problem, and it is the single most common thing we are asked about on the Grow side.
In most cases one of three things is true: conversion tracking was never installed correctly, enquiries arrive by routes nobody counts — phone calls, walk-ins, replies to a personal inbox — or the numbers exist but sit in four dashboards that disagree with each other. You are not failing to read the data. There is no single version of it to read.
Define one thing that counts as a win — a booked call, a submitted form, a completed sale. Then check it is actually being recorded. Broken or missing conversion tracking is so common that we treat it as the default assumption until proven otherwise, and until it is fixed every other number on this list is decoration.
Not a dashboard with forty numbers. Three numbers you trust: how many enquiries arrived, where they came from, and what a customer costs you to acquire. Most organisations we meet cannot answer the third, which is the one that decides whether any of the spending is sensible.
Once this is measured properly, you will probably discover that something you have been paying for monthly is producing very little. That is the point, and it is usually uncomfortable — often the thing that looks busiest is the thing contributing least.
The question is almost never really about technology. It is about whether anyone is accountable. A board asking this is asking whether someone owns the risk. An insurer is asking whether you qualify for the price they quoted. A client is asking whether you are a safe link in their own supply chain.
Those three want different evidence, and the most common mistake is answering with a list of products. “We have antivirus and a firewall” reads, to all three audiences, as though nobody is in charge.
Treat the application as a technical questionnaire with contractual weight, because that is what it is. Questions about multi-factor authentication, backups, endpoint protection and patching are conditions, not curiosity. Answering optimistically is the genuinely dangerous move — a claim can be challenged on the basis of what you attested to. If you are not certain, verify before you tick.
Expect a questionnaire that was written for a company twenty times your size. It is reasonable to answer “not applicable at our scale, and here is what we do instead”. Do not invent a policy to fill a box. If you claim one, you may be asked to produce it and to show it is followed.
One page covering the four points above. That page is worth more than any tool purchase, because it is what turns scattered good practice into something you can show. Being able to evidence what you do is now part of doing it.
This page grows from real situations, not from a list we invented. If something happened to you and it is not here, tell us — anonymised, no detail we would ever publish, and we will write it up so the next person finds an answer instead of a panic.
If money is moving right now, stop reading and phone your bank — use the word fraud. Then report it to the Canadian Anti-Fraud Centre. Speed matters more than getting the sequence perfect.
Several of these are questions people carried around for months without getting a straight answer. If one of them is yours, book a free conversation or just email the question. No pitch, no obligation.
And we will tell you if you do not need us. Some of what is on this page you can do yourself in an afternoon, and we would rather say so than sell you something.
Redefine LogicWe help small businesses, nonprofits and co-ops grow safely — marketing that brings people in, security that protects what you build.
© 2026 Redefine Logic Media™. All rights reserved.
Redefine Logic Mediaâ„¢ is committed to making this website usable by as many people as possible, regardless of ability or the technology they browse with. We treat accessibility as ongoing work rather than a one-time task.
We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at Level AA. We test with keyboard-only navigation, screen readers and automated tooling, and we fix issues as we find them. We are not claiming full conformance across every page — where we fall short, we want to know.
This site includes an accessibility toolbar that lets you adjust the page to suit how you read and navigate. It changes only how the page is presented in your browser; it does not send your choices anywhere, and it does not replace the underlying accessible markup of the site.
The toolbar can:
This site is built to work with screen readers such as NVDA, JAWS, VoiceOver and TalkBack, and to be fully operable with a keyboard alone. If you use assistive technology and something does not work as expected, that is a bug on our side, not yours — please tell us.
Some third-party content — embedded maps, videos, payment forms and social feeds — is outside our direct control and may not meet the same standard. Where we can, we provide an accessible alternative. Where we cannot, we will help you get the same information another way.
If you hit something on this site you cannot use, please get in touch through the contact details on this site. Tell us the page and what went wrong, and we will respond and work with you on an accessible alternative.
Accessibility toolbar by Redefine Logic Media.