Everything I.T.

Most of the tools your team uses to get work done are probably not on your IT list.

Some examples: personal Dropbox accounts for client files, ChatGPT with confidential information pasted in, a Trello board the marketing team set up a year ago, a Notion workspace someone in operations runs from their phone. The name for all of this is shadow IT, and every business has more of it than you'd guess.

The risk shows up in two places. First, data that should live inside your business sits inside accounts you don't control and can't delete. When an employee leaves, the data stays where they put it. Second, none of those tools are configured with your security in mind. MFA settings are weak or off, and there's no data loss prevention, retention policy, or audit log to check when something goes wrong.

You don't need a top-down crackdown to fix this. Ask four questions in your next team meeting:

1. What software or web tool are you using this week that wasn't installed by IT?
2. Which one would slow your work down the most if it disappeared tomorrow?
3. Is any client or company data sitting in it?
4. Would you be embarrassed if it leaked in a breach?

Run the conversation as a fact-finding exercise. The helpful tools get sanctioned, the risky ones get replaced.

If you don't know what's running in your business, you can't protect it.

If you've ever spent 5 minutes hunting through Teams trying to find a meeting recording, there's a feature you should be using.

It's called the Meet app, and it's already built into Teams. No Copilot license required.

The Meet app gives you a single dashboard for every meeting you've had or are about to have. Click on any meeting and you get the agenda, recording, transcript, chat, and shared files, all in one place.

To find it:

1. Open Teams

2. Click the three dots on the left navigation bar

3. Search for "Meet"

4. Right-click and pin it so it stays in your sidebar

Once pinned, you'll see two views: upcoming meetings and past meetings. Click any past meeting to see everything tied to it.

Finding what was discussed in last month's leadership review used to take 5 minutes of digging through your calendar, recordings, and SharePoint.

With Meet, it takes 30 seconds.

In April 2026, ransomware hit Adaptavist, an Atlassian platinum partner that builds and supports tools for thousands of business customers.

Adaptavist makes ScriptRunner and similar add-ons that plug into Atlassian products like Jira and Confluence. When attackers got into Adaptavist's systems, every customer connected to those tools was suddenly downstream of a breach they didn't cause.

This is the supply chain attack pattern. Your business doesn't have to be the target. It just has to share a vendor with the target.

Three things worth doing this month:

-Make a one-page list of every SaaS vendor your business depends on. Email, accounting, payroll, CRM, helpdesk, file storage, project management. The list is usually longer than you'd expect.
-For each vendor, find their security and breach notification page online. If you can't find it in five minutes, that's information worth knowing.
-For the top five vendors by data sensitivity, ask three questions in writing: do you have a current SOC 2 Type II report, what's your breach notification SLA, and how do you handle credentials inside your support tooling.

You can't control every vendor's security. Pick the ones that take it seriously.

Adaptavist Group breach: Ransomware crew claims mega-haul : Fake emails already doing the rounds as ransomware crew boasts about what it allegedly stole

Your business email is worth more than your bank account.

Stolen Microsoft 365 credentials remain the most common starting point for SMB breaches in 2026, and the reason isn't just that attackers can read your messages.

Once someone has access to your email, they can reset the password for every other account tied to that address.

Your bank, your accounting software, your CRM, your cloud storage.

Email is the master key to your entire digital business.

What attackers typically do once they get in:

▶️ Set up mailbox forwarding rules so they keep seeing your replies after you change the password

▶️ Send invoice fraud emails to your clients from your real account, often changing wire transfer details

▶️ Sit for weeks, learning your business, before making a move

Three things that meaningfully reduce this risk:

✅ Use phishing-resistant MFA where possible (FIDO2 hardware keys or Windows Hello for Business). Authenticator app prompts are better than nothing, but they can still be bypassed.

✅ Set up Conditional Access policies in Entra ID to block logins from countries you don't operate in.

✅ Review your mailbox forwarding rules monthly. In Outlook, go to Settings > Mail > Forwarding. If you see a rule you didn't create, that's a sign your account is compromised.

The monthly audit takes 5 minutes and it’s one of the highest-leverage security habits you can build.