Employees often use personal devices for work before the business has made a decision about it. They add work email to a phone, download a file to a home laptop, or sign into a company app from a computer shared with family.

Once business data is stored on a personal device, you have less control over updates, installed apps, backups, and who else uses the device. You also need a way to remove company data when the employee leaves or the device is lost.

Personal devices can be allowed, but the business should decide which devices, applications, and types of work are permitted.

What BYOD includes

Bring your own device, usually shortened to BYOD, means an employee uses a personally owned phone, tablet, or computer for work.

That can include:

• Adding work email to a personal phone
• Signing into Microsoft 365 or Google Workspace
• Joining online meetings
• Opening customer or company files
• Using a business messaging app
• Accessing accounting, CRM, or project management software
• Downloading documents to a personal computer

Depending on the application, business information may remain in the cloud or be downloaded to the device as messages, attachments, cached data, or files.

What you cannot fully control on a personal device

Your IT team can set and monitor security on company-owned devices. With personal devices, employees choose which apps to install, when to update the operating system, who else uses the device, and where files are backed up.

Management software can enforce some rules, but the available controls depend on the device, operating system, application, and enrollment method.

Other people may use the device

An employee may share a home computer or tablet with a partner, child, or another family member. Separate user accounts can reduce the risk, but many personal devices are used through one shared account.

The UK National Cyber Security Centre says BYOD access should not be permitted when an employee cannot follow the required security rules. Its example includes a device that cannot keep the employee’s work separate from other family users. NCSC BYOD guidance

Updates may be missing

Your IT provider may not be able to confirm whether a personal device runs a supported operating system or has current security updates.

An employee may delay an update because the device lacks storage, an older application might stop working, or the device is rarely restarted.

Business files may enter personal storage

A file downloaded from work email or cloud storage may remain in the Downloads folder, a personal document folder, or a device backup.

A personal cloud backup service could then copy the file to an account the business does not manage. Opening the document in a personal application may create another unmanaged copy.

Other applications may access business information

Personal devices contain applications chosen by the employee. Some may have permission to read files, contacts, browser activity, or information copied to the clipboard.

The business may not know which applications are installed or what those applications can access.

Repairs can expose business data

A broken personal phone or laptop may be taken to a repair shop chosen by the employee. Business email, saved sessions, or downloaded files could still be available on the device.

Your policy should tell employees who to contact before a device is repaired and what to do if the device cannot be opened.

Company data may remain after employment ends

Disabling an employee’s account stops future access to many cloud services. It does not remove copies that were downloaded to personal folders, opened in unmanaged applications, or copied to personal storage.

Managed work profiles and protected applications make it easier to remove company data. They can only remove the information they control.

Decide what work is allowed

Set access based on the work being performed and the information involved.

You might allow employees to read work email through an approved mobile app while requiring a company computer for customer database exports. Staff handling financial records, health information, legal documents, or large amounts of customer data may also need company-owned devices.

Administrative work should be performed from a managed device. Anyone responsible for user accounts, security settings, backups, or business systems should not do that work from an unmanaged personal computer.

Apply the same rules to contractors. Their access should be limited to the applications and information required for their work.

Security requirements for personal devices

A personal device should meet your requirements before it can access company information.

Use a supported operating system

The device should run an operating system that still receives security updates. Block access from devices that can no longer install current updates.

Install security updates

Operating system and application updates should install automatically where possible. Employees should restart their devices when an update requires it.

Require a screen lock

Require a PIN, password, fingerprint, or facial recognition to unlock the device. Configure the screen to lock automatically when the device is not being used.

Require device encryption

Encryption helps protect stored information if a device is lost or stolen. The Australian Cyber Security Centre recommends full-device encryption when personal devices may store business information. Cyber.gov.au BYOD guidance

Encryption must be enabled before the device is lost. It also needs to be supported by a strong device password or PIN.

Require MFA

Require MFA for work email, cloud storage, and other important systems. The NCSC recommends MFA as a minimum for BYOD access.

Use MFA for account sign-ins. Protect downloaded information with encryption and managed applications.

Block rooted or jailbroken devices

Rooting or jailbreaking removes some of the operating system’s built-in restrictions. These devices should not be allowed to access company data.

Detection is not perfect, so it should be used with the other security controls in this article.

Approve the applications used for work

Tell employees which applications they may use for email, messaging, file access, and other work.

Where your management service supports it, prevent business information from being saved to personal storage or copied into unmanaged applications.

Use separate accounts on shared computers

A personal computer used for work should have a separate account for the employee. Other users should have their own accounts and should not know the employee’s password.

Do not allow BYOD access when work cannot be kept separate from other users of the device.

Tell employees how to report problems

Employees need to know who to contact if a device is lost, stolen, repaired, replaced, or infected with malware.

Early reporting gives the business more time to disable access, check account activity, and remove managed data.

Control business data with managed apps or work profiles

Device and application management services can help keep work information separate from personal information.

Mobile device management, or MDM, can apply settings to an enrolled device and report whether it meets company requirements. The amount of control depends on the platform and enrollment method.

Mobile application management, or MAM, applies controls to supported work applications and their data. Depending on the product, it may restrict copying, block saving to personal storage, require another PIN, or remove company information from managed apps.

For example, Microsoft Intune can remove company data from protected applications when a device is lost or an employee leaves. Personal information can remain on the device.

Selective removal only affects data managed by the service. It cannot delete a file copied into an unmanaged application, personal backup, or unsupported storage location.

A factory reset removes personal and business data. Microsoft warns administrators about the risk of applying full device management to computers and phones the business does not own. Configure selective removal where possible and tell employees exactly what your management service can see and do. Microsoft Intune planning guide

What your BYOD policy should cover

Your policy should answer these questions:

• Which employees and contractors may use personal devices?
• Which types of devices are permitted?
• What work can be performed on them?
• Which applications must be used?
• Can company files be downloaded?
• Can the device be shared with other people?
• Which security settings are required?
• What information can the business or IT provider see?
• What settings can the business control?
• Can company information be removed remotely?
• What happens if the device is lost or stolen?
• What must happen before the device is repaired or sold?
• What happens when the employee leaves?
• Who pays for mobile data, repairs, or replacement?

Privacy, employment, and data protection requirements vary between countries. Have the policy reviewed for each location where you employ people.

Employees should read and accept the policy before company access is added to their devices.

What to do when a personal device is lost or stolen

The employee should contact the business or IT provider as soon as possible.

Your response may include:

1. Disabling access if the device cannot be accounted for
2. Revoking active sign-in sessions
3. Removing company data from managed applications
4. Removing the device from approved-device lists
5. Checking account activity for unexpected sign-ins
6. Resetting credentials if they may have been exposed
7. Recording which company files may have been stored on the device

Remote locking and removal commands only work after the device connects to the management service. A device that remains switched off or offline may never receive the command.

Encryption and account controls are still required because remote removal might not run.

What to do when an employee leaves

Disable the employee’s account and revoke active sessions at the agreed time. Remove company data from managed applications or work profiles.

Check whether business files were downloaded to the device and confirm how those copies will be returned or deleted.

Remove the device from your approved-device records. Where your management service supports it, remove business applications, certificates, email profiles, and VPN settings.

When personal devices should not be allowed

Provide a company-owned device when:

• The employee handles sensitive information
• The role requires administrator access
• Large amounts of company data must be stored locally
• The device is shared with other people
• The operating system is no longer supported
• Encryption cannot be enabled
• The business cannot separate or remove its data
• The employee does not accept the required security controls
• The device has been rooted or jailbroken

Company-owned devices are easier for your IT provider to support because their settings and installed software are known.

Frequently asked questions

Can employees use a web browser without enrolling their personal device?

You can allow browser access, but information may still remain in the browser cache, Downloads folder, saved passwords, screenshots, or active sessions.

Access policies can limit the devices and browsers that are permitted. Sensitive work may still require a managed device.

Is MFA enough to secure a personal device?

MFA helps protect the employee’s account. Device encryption protects stored files, while managed applications control how company information is used and copied.

You still need updates, screen locks, approved applications, and a process for lost devices.

Can the business see an employee’s personal information?

It depends on the management method. App management focuses on business applications and their data. Device enrollment can show device details and allow broader control.

Give employees a written explanation of what your IT team can see, change, lock, or remove before they enroll.

Can the business erase a personal phone?

Some enrollment methods support a full factory reset, while app-only management does not. A factory reset deletes personal information as well as company data.

Use selective removal for employee-owned devices where it is available.

Is BYOD cheaper than providing company devices?

BYOD may reduce hardware purchases, but it can add costs for management, support, security, and administration. Whether it saves money depends on the devices, applications, and work you allow.

Sources and further reading

• NCSC: Bring your own device guidance
• NCSC: BYOD costs and security requirements
• Australian Cyber Security Centre: Risk management of enterprise mobility and BYOD
• Australian Cyber Security Centre: Securing customer personal data
• Microsoft Learn: Protect data and devices with Intune
• Microsoft Learn: Remove company data from protected applications
• Microsoft Learn: Intune planning guide

If employees already use personal devices for work, ask your IT provider to check what they can access and whether the required controls are in place.

And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it out.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post Should Employees Use Personal Devices for Work? appeared first on Solve IT Solutions LLC.

Most owners only look at their IT when something has already gone wrong. A file won’t open, a laptop won’t start, or an invoice gets paid into a scammer’s account. Fixing it at that point costs more than preventing it would have.

Almost none of it happens without warning. The backup that fails when you finally need it had been failing for weeks. The account a scammer used belonged to someone who left last year. Thirty minutes a month is usually enough to catch that kind of thing.

Why a monthly look is worth the time

Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches started with attackers exploiting software that hadn’t been patched. That makes unpatched software the most common way in, ahead of stolen passwords. The same report found the median time to fully fix a known problem has risen to 43 days.

Most attacks use a problem that was already known, with a fix already available. Nobody had installed it yet.

The check

1. Updates

Check whether Windows updates are installing on your computers, or sitting at “restart required” week after week. Do the same for phones and for the software you use most, like your browser and your accounting app. If people keep clicking “remind me later,” that’s something to fix.

2. Backups

Open your backup tool and look at the last few runs. You want recent successful backups, not a list of errors. Then check when anyone last restored a file from it. If it’s never been tested, you don’t know whether it works.

3. Who has access

Pull up the list of user accounts in Microsoft 365 or Google Workspace and read through it. Every name should be someone who still works for you. Look for people who left, contractors who finished months ago, and shared logins like “office” or “admin” that several people use. Switch off anything you don’t need.

4. Multi-factor authentication

Check that MFA is switched on, and that it’s on for everyone, not just the people who set it up first. Pay closest attention to admin accounts and anyone who handles money. Microsoft’s research shows MFA blocks more than 99.2% of account compromise attacks.

5. Devices

Look at what’s connected to your systems. If there’s a laptop or phone you don’t recognize, find out whose it is. While you’re there, check that laptops are encrypted and that any phone with company email on it has a passcode or fingerprint lock.

6. Subscriptions and licenses

Open your billing page and read what you’re paying for. Businesses regularly pay for licenses belonging to people who left, or for two tools that do the same job. It’s also how you find software somebody signed up for without telling anyone.

Make it a routine

Put it in the calendar on a fixed day, like the first Monday of the month, and give it to the same person each time. That’s you or whoever handles the admin side.

Keep a running note of what you checked and what you found. After a few months you’ll see whether the same problem keeps coming back. If it does, it needs fixing properly instead of clearing each time.

Thirty minutes only works if you don’t stop to fix things along the way. Write down what you find and deal with it afterward.

Who fixes what

Most of it is small, like a laptop that needs restarting, a license to cancel, or an account to switch off. Handle those yourself.

Send the rest to your IT provider: backups that keep failing, MFA that won’t turn on for someone, a device nobody recognizes, or updates that fail on the same machine every month. Those usually mean there’s a bigger problem behind them.

What this check doesn’t do

It isn’t monitoring. A good IT provider has tools watching your systems all day and flagging things you’d never spot from a monthly glance.

The check covers what those tools can’t know. You know who left, which subscriptions you approved, and whose laptop is whose.

Frequently asked questions

How often should a small business check its IT?

Once a month is enough for this list. Backups are worth a quick look more often if losing a day’s work would seriously hurt, since that’s the item most likely to fail quietly.

Who should do it?

You or whoever runs the admin side of the business. Most of the list needs no technical skill, just someone who knows who works there and what the business pays for.

What if I don’t know where to find any of this?

Ask your IT provider to walk you through it once and write down where each thing lives. Many will also send you a monthly summary covering most of it.

Isn’t this my IT provider’s job?

They handle the monitoring, the patching, and the fixing. The check is the part that depends on knowing your business, like who left last month or which subscription nobody approved.

If I only have ten minutes, what matters most?

Backups and updates. Without working backups you can lose everything you’ve stored, and unpatched software is now the most common way attackers get in.

Does this apply if everything we use is in the cloud?

Yes. Cloud tools still need updated devices, working backups, MFA switched on, and access lists that match who actually works for you.

Sources and further reading

• Verizon 2026 Data Breach Investigations Report — the finding that 31% of breaches start with exploitation of unpatched software, and that the median time to fully fix a known problem is 43 days.
• Microsoft: Plan for mandatory Microsoft Entra multifactor authentication — Microsoft’s research that MFA blocks more than 99.2% of account compromise attacks.

If you’d like a hand setting this up, your IT provider can show you where each of these lives in your systems and take the fixing off your plate. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post The 30-Minute IT Check Every Small Business Should Do Once a Month appeared first on Solve IT Solutions LLC.

Most of your business probably runs in the cloud now. Email, files, accounting, bookings, payments, it’s all online. Then one day a service goes down, and nobody can send an email, open a file, or take a payment.

It doesn’t take a hacker for this to happen. In July 2024, a faulty software update from the security company CrowdStrike crashed millions of Windows computers around the world in a few hours. Microsoft estimated it hit 8.5 million devices, grounding flights and stopping work at banks and hospitals.

Outages happen, even to the big names

Microsoft 365 itself has had days where email or Teams stopped working for hours. Internet providers have bad days too, and when yours does, everything online goes with it. Any tool you depend on can go down.

So much of a small business runs on a handful of online services now, and if one goes down, the work that depends on it stops until it’s back. Being with a big, well-known provider doesn’t protect you from this.

What an outage does to a small business

When a key service goes down, your team can’t get to email or files, so work stops. If your payment or booking system is offline, you can’t take money or appointments. Customers try to reach you and can’t, and you can’t reach them either. Staff end up sitting around waiting.

You usually can’t fix it yourself. When a big provider has an outage, all you can do is wait for them to sort it out. The goal of a plan is to keep working, and keep customers informed, until they do.

What a simple plan covers

A good plan answers these questions:

• Which tools are critical? List the handful of services that would stop the business if they’re down, like email, your payment system, or your booking tool. Ignore the ones you could live without for a day, and focus on the few that would halt the work.
• How will people keep in touch? Have a backup way to reach staff and customers that doesn’t depend on the tool that’s down. That might be phone numbers, a group chat on a different app, or text messages.
• What do you need reachable offline? Keep a copy of the essentials, like your customer contact list, key phone numbers, and important documents, somewhere you can open if the main system is down. A printout or a copy on a phone is enough.
• Who’s in charge? Decide who makes the decisions during an outage and who keeps customers updated. When it’s clear in advance, people act instead of waiting to be told.
• Where do you check, and who do you call? Know where to see whether it’s a wider outage, which is usually the provider’s status page, and who to call for help, which is usually your IT provider.

What to do the moment an outage hits

1. Check whether it’s just you. Look at the provider’s status page, or ask whether anyone else is having the same problem. If it’s a wider outage, there’s nothing to fix on your end, so stop trying.
2. Tell your team. Let people know what’s down and what to use instead, so nobody wastes an hour rebooting a laptop that was never the problem.
3. Switch to your backup way to communicate. Move to the phone, text, or another app so the team can still coordinate.
4. Tell customers if it affects them. If you can’t take bookings or payments, say so and tell them when to try again.
5. Note when it started and what’s affected. A couple of lines is enough. It helps you follow up afterward and spot anything that needs fixing once things are back.

A few things that make outages hurt less

• Keep key files available offline. With OneDrive or SharePoint, recent files can sync to the device so you can still open them when the service is down. Ask your IT provider to make sure this is set up.
• Have a backup way to get online. A mobile hotspot from a phone can get a few key people working again if your main internet drops.
• Know your status pages. Bookmark the status page for Microsoft 365 and your other main tools. It’s the fastest way to tell whether the problem is them or you.
• Keep contacts off the cloud. Have your important phone numbers and contacts somewhere that doesn’t need the internet, like a printout or your phone’s own contact list.
• Ask your IT provider about alerts. Many can set up a warning that tells you about an outage before your customers do.

Keep your plan on one page

Keep this to a single page, somewhere you can reach without your main systems, whether that’s printed or in a separate app. Write down your critical tools, your backup way to communicate, where the essentials live, who’s in charge, and who to call. Review it once or twice a year so the names and numbers stay current.

Frequently asked questions

Isn’t the cloud always available?

No. Cloud services are reliable, but they still have outages, and even the biggest providers go down sometimes. The CrowdStrike outage in 2024 took millions of computers offline in a few hours. It’s safer to assume an outage will happen eventually and have a plan for it.

What should a continuity plan include?

The basics: which tools are critical, a backup way to reach staff and customers, where to find essential information if the main system is down, who’s in charge during an outage, and who to call for help. One page is enough for most small businesses.

What if the internet itself goes down, not just one app?

Plan for that too. A mobile hotspot from a phone can get key people back online, and a phone call still works when your systems don’t. Keep important numbers and contacts somewhere that doesn’t need the internet.

How can my team keep working if Microsoft 365 is down?

It depends on the work, but options include using files already saved on a synced device, switching to phone or text to stay in touch, and handling anything urgent on paper until service returns.

How long do outages usually last?

There’s no set answer. Some are fixed in minutes, others take most of a day. That’s the reason to plan around them, since you can’t count on a quick fix and you can’t speed it up from your end.

Whose job is this?

Yours, with help from your IT provider. They can tell you which of your tools are most at risk, set up things like synced files and a status-page alert, and help you write a simple plan.

Sources and further reading

• Microsoft: Helping our customers through the CrowdStrike outage — Microsoft’s estimate that 8.5 million Windows devices were affected.
• CISA: Widespread IT Outage Due to CrowdStrike Update — the US cyber agency’s alert on the incident.

If you’re not sure which of your tools would hurt most if they went down, or you’d like help putting a simple plan together, your IT provider can work through it with you. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post How to Keep Your Business Running When Microsoft 365 Goes Down appeared first on Solve IT Solutions LLC.

If your business runs on Microsoft 365, you’ve got two places to store files: OneDrive and SharePoint. Most people are never told the difference, so files end up wherever is easiest, spread across OneDrive, SharePoint, Teams, and the desktop.

That’s how you end up with the everyday headaches: a file nobody can find, a document only one person can open, and a scramble to recover someone’s work after they leave. The rule for where things should go is simple once you know what each one is for.

What each one is for

OneDrive is your own space. Think of it as the cloud version of the My Documents folder on your computer: your work files, private to you unless you choose to share them. It’s the right place for drafts and anything only you need.

SharePoint is the team’s space. It’s built for files with shared ownership, the documents your team, department, or the whole business works on together. Microsoft’s own advice is straightforward: if you’re working on something by yourself, save it to OneDrive; if you’re working as a team, save it where the team works.

Where Teams fits in

Microsoft Teams confuses this for a lot of people, because it looks like a third place to keep files. In reality, when you upload a file to a Teams channel, it’s stored in that team’s SharePoint site. The Files tab in Teams is just a view into SharePoint.

So if your team works in Teams, your shared files are already in SharePoint, whether you realized it or not. That’s a good thing. It means the files have shared ownership and don’t belong to one person’s account.

So where should your files live?

Here’s the rule that keeps things simple:

• If it’s your own draft or something only you need, keep it in OneDrive.
• If the team needs it, more than one person works on it, or it’s a client or project file, put it in SharePoint (or the Teams channel for that work, which is the same thing).
• Don’t leave important shared files sitting only on someone’s desktop or only in their personal OneDrive.

Sharing files the right way

Where a file lives also changes how you share it.

When you share a file from your OneDrive, you’re sending people into your personal space, usually with a link tied to your account. That works, but the link depends on you. If you leave, or the file moves, those links can stop working, and whoever relied on them is stuck.

In SharePoint or a Teams channel, the right people already have access, because the files belong to the team rather than to you. You can point a colleague to the folder and they’re in, with no one-off links to manage.

It’s also worth sharing a link instead of emailing a copy. When everyone opens the same file in OneDrive or SharePoint, they’re all looking at the current version, and you avoid ending up with five slightly different copies attached to five different emails.

Why this matters

Putting files in the right place saves you real trouble later.

Take what happens when someone leaves. Their personal OneDrive isn’t shared by default, so any important work kept only there can be hard to reach. Microsoft holds a deleted user’s OneDrive for 30 days by default and gives their manager access, but that turns into a rush against the clock. Files kept in SharePoint stay with the team no matter who comes or goes.

It also makes files easier to find. When the team’s documents live in one shared SharePoint library, people know where to look, instead of hunting through inboxes and personal drives.

And it helps you recover from mistakes. Both OneDrive and SharePoint keep older versions of your files and a recycle bin, so if a document gets overwritten or ransomware scrambles your files, you can roll back to a clean copy instead of starting over.

How to get it right

• Put shared work in SharePoint or Teams. Anything the team works on together belongs in a shared library. Keep it out of one person’s OneDrive.
• Keep OneDrive for your own files. Drafts and personal work are fine there. Just don’t let it become the only home for something the team needs.
• Get files off local desktops. A file saved only on a laptop isn’t backed up, isn’t shared, and is gone if the laptop is lost. Move important files into OneDrive or SharePoint. You can still work from your computer the way you always have: the OneDrive app keeps a copy on the device for offline use and saves your changes to the cloud automatically.
• Agree where things go. A simple, shared rule, like “client files live in the client’s SharePoint folder,” saves endless confusion later.
• Use version history when you need it. If a file gets changed or deleted by mistake, you or your IT provider can restore an earlier version rather than redoing the work.

Frequently asked questions

What’s the difference between OneDrive and SharePoint in one line?

OneDrive is for your own work files. SharePoint is for files your team shares.

Where do files in a Teams channel get stored?

In SharePoint. Every team has a SharePoint site behind it, and the Files tab in a channel is a view into that site. Uploading a file to Teams is the same as putting it in SharePoint.

Should I keep work files on my computer’s desktop?

Try not to, for anything important. A file only on your desktop isn’t shared or backed up, and it’s gone if the device is lost or breaks. Save it to OneDrive or SharePoint instead, where it’s protected and reachable.

What happens to files in someone’s OneDrive when they leave?

By default, Microsoft keeps a deleted user’s OneDrive for 30 days and gives their manager access, and that window can be extended if it’s set up in advance. It’s recoverable, but it’s far easier if shared work was in SharePoint to begin with.

Can I get back a file that was deleted or changed by mistake?

Usually, yes. OneDrive and SharePoint both keep a recycle bin and older versions of files, so you can restore a deleted file or roll back to an earlier version. Your IT provider can help if you can’t find it.

Sources and further reading

• Microsoft: Should I save files to OneDrive or SharePoint? — Microsoft’s own guidance on which to use.
• Microsoft: File storage in Microsoft Teams — how Teams files are stored in SharePoint.
• Microsoft: Set the OneDrive retention for deleted users — what happens to a leaver’s OneDrive and the 30-day default.

If your files are scattered and you’re not sure what should sit where, your IT provider can set up a simple structure in SharePoint and move things into the right place, so files are easy to find and safe when people come and go. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post OneDrive or SharePoint? Where Your Business Files Should Live appeared first on Solve IT Solutions LLC.

When you search Google for a program to download or a website to log into, the first thing you see is usually an ad. It sits at the top, marked “Sponsored,” and most people click it without a second thought, because the top result is normally what you wanted.

Scammers count on that. They buy ads on the names of trusted companies and popular software, so their fake site appears right at the top, above the real one, and you click it thinking it’s the official page.

How the scam works

The trick is called malvertising, short for malicious advertising. A scammer buys a search ad for a term people trust, like the name of your bank, a Microsoft login, or a common program such as a PDF reader or a video player. The ad looks normal, with the real brand name and a web address that looks right.

When someone clicks it, they land on a page built to look exactly like the real one. Sometimes that page asks you to log in and hands your username and password straight to the scammer. Other times it offers the software you were after, and the download installs malware instead of the real program.

Why these ads are so easy to fall for

These ads are convincing. They sit above the real result, so they’re the first thing you see. They use the real company’s name and a web address that looks right. And they show up on a search you started yourself, so they don’t feel as suspicious as a random email or text would.

Attackers have also gotten good at hiding from the checks meant to stop them. They show a clean, harmless page to the ad reviewers and the real, malicious page to everyone else, so the ad can pass review and still do damage.

How common is this?

Very. In its 2025 Ads Safety Report, Google said it blocked or removed more than 8.3 billion ads that broke its rules, suspended 24.9 million advertiser accounts, and took down 602 million ads tied to scams. Google also noted that criminals are now using AI to make fake ads faster.

Security researchers have found scam search ads pretending to be well-known programs like VLC, 7-Zip, and CCleaner, and even Google’s own apps, with downloads that installed password-stealing malware. These show up on the everyday searches your team runs.

What this means for your business

For a business, the risk comes up in two everyday situations: downloading software, and logging in.

When someone downloads software, they search for a tool, click the top ad, and install something that steals the passwords and logins saved in their browser.

When someone logs in, they search for “Microsoft 365 login” or their bank, click the ad rather than the official link, and type their username and password straight into a fake page.

In both cases, the problem is info-stealing malware. Once it’s on a machine, it can steal saved passwords, browser cookies, and session tokens, which can get an attacker into accounts even when multi-factor authentication is switched on.

How to protect your team

• Scroll past the sponsored results. The ads sit at the top, marked “Sponsored” or “Ad.” The real website is usually just below, in the normal results.
• Don’t download software from an ad. Type the maker’s web address yourself, or search and use the normal result, then download from the official site.
• Bookmark the sites you log into. For your bank, Microsoft 365, and other important accounts, use a saved bookmark instead of searching each time.
• Keep devices and browsers updated. Turn on automatic updates so a bad download is less likely to work.
• Tell your team this is a thing. Most people have no idea the top result can be a trap, and once they know, they stop clicking it.

Frequently asked questions

Aren’t ads at the top of Google checked and safe?

Google reviews ads and removes billions that break its rules, but scammers still slip through by showing reviewers a clean page and everyone else the malicious one. A “Sponsored” label doesn’t mean the site is safe.

What is malvertising?

Malvertising is short for malicious advertising: scammers buy online ads, often on trusted brand names, to send people to fake sites that steal logins or install malware.

How do I download software safely?

Go to the maker’s official website by typing the address yourself, or search and use the normal (non-ad) result. Don’t download from a sponsored ad, and don’t trust a download that arrives through one.

What should I do if someone clicked a scam ad?

If they only visited the page, close it and don’t enter anything. If they typed a password, change it and turn on MFA. If they downloaded and ran a file, disconnect the device and have your IT provider check it for info-stealing malware.

Does an ad blocker help?

It can. A reputable ad blocker hides many sponsored results, which takes the fake links off the page before anyone can click them. It isn’t a complete fix, so keep the habits above too.

Sources and further reading

• Google: 2025 Ads Safety Report — Google’s own figures on the scale of scam and policy-breaking ads.
• FTC: Online search results — the good, the bad, and the scammy — US consumer guidance on scrolling past ads and downloading software safely.
• BleepingComputer: Malware pushed via Google search ads for VLC, 7-Zip, CCleaner — a real example of scam ads impersonating popular software.

If you’d like to give your team a plain rundown of what a scam ad looks like, or tighten how software gets installed on your computers, your IT provider can help with both. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post Why You Should Scroll Past the First Result on Google appeared first on Solve IT Solutions LLC.

For years, the advice for spotting a scam email was simple: look for bad spelling and clumsy grammar. A real bank or supplier writes properly, the thinking went, so a message full of mistakes was probably fake. It was easy to teach, and for a long time it worked.

It doesn’t anymore. Scammers now use AI to write their emails, and AI writes cleanly. The typos and awkward phrasing that used to give phishing away are gone, and the messages landing in your team’s inbox read as well as anything from a real company. Worse, they can be written to sound like they came from someone you already know.

Why the old advice stopped working

The spelling-and-grammar tell worked because a lot of scammers were writing in a language that wasn’t their own, and the mistakes showed. AI took that away.

The UK’s National Cyber Security Centre says generative AI can now create convincing phishing lures “without the translation, spelling and grammatical mistakes that often reveal phishing.” The FBI says the same: criminals use AI to limit the grammar and spelling errors that used to mark a message as fake, so it reads as believable. That means the one thing most people were trained to look for no longer tells you much.

Why these emails are so convincing now

• The writing is clean. A scam email reads like a normal business email, because a machine wrote it in seconds, in whatever tone the attacker asked for.
• It’s personal. Attackers can feed public details about your company into an AI tool, pulled from your website, your team’s LinkedIn profiles, or a press release, and get a message tailored to you: the right names, the right job titles, and a believable reason to be in touch.
• There’s more of it. AI makes each message faster to produce, so attackers send far more. The FBI’s Internet Crime Complaint Center added a section on AI to its annual report for the first time, tied to more than 22,000 complaints and nearly $893 million in reported losses.

These days, the scam email isn’t the obvious one anymore. Instead of “Dear customer, your account is suspended,” someone in your finance team gets a message that looks like it’s from a supplier they really deal with, mentions a real project, and asks to update the bank details for the next invoice. It reads exactly like a real supplier email. The only thing wrong is that the supplier never sent it.

Your spam filter won’t catch them all

It’s tempting to assume your email security will handle this. It catches a lot, and you should keep it switched on. But a well-written, personalized email that asks a normal-sounding question doesn’t always look dangerous to a filter, especially when it carries no obvious bad link or attachment. Both the NCSC and the FBI expect AI to push more of these messages through, which is why the last line of defense is a person who knows what to check.

It’s not just email anymore

AI has done the same thing to phone calls and texts. The FBI warns that criminals can clone a voice from a short audio clip, enough to leave a voicemail that sounds like your boss or a family member asking for an urgent payment. The same thing that makes AI emails so convincing makes AI phone scams convincing too. The defense is the same: if a call or voicemail asks for money or logins, hang up and call the person back on a number you already have.

Here are the signs you should still pay attention to

If you can’t trust how an email is written, look at what it’s asking you to do. That’s where the real warning signs are, and AI hasn’t changed them:

• It asks for money, gift cards, or a payment to a new account.
• It asks for a login, a verification code, or personal details.
• It creates pressure: a deadline, a threat, or a “do this now.”
• It asks you to change the bank details for an invoice or a supplier.
• It comes with a link or attachment you weren’t expecting.
• The display name looks right, but the actual email address doesn’t match it.

Every one of these is about what the email is asking for. So the rule to teach your team is simple: when a message is about money, logins, or how you pay someone, slow down before you act.

How to protect your team

• Check money and login requests another way. If an email asks you to pay a new account or change a supplier’s bank details, call the person on a number you already have. Don’t reply to the email or use a number it gives you.
• Stop telling staff to watch for bad spelling. Tell them to look at what the email is asking for, and to slow down when it’s about money or logins.
• Make one rule for payment changes: confirm every change to bank details by phone, even when it’s urgent.
• Turn on phishing-resistant MFA or passkeys, so a stolen password is harder to use even if someone gets tricked.
• Make it easy to report a suspicious email and make sure nobody feels silly for checking.
• Remind the team now and then that scam emails look perfect these days. A quick five-minute chat beats a poster nobody reads.

Frequently asked questions

Can you still spot a phishing email by bad spelling and grammar?

Not reliably. Attackers use AI to write clean, correct emails now, so a message with perfect spelling can still be a scam. Judge it by what it asks you to do.

What are the warning signs that still work?

The request itself: paying money, changing bank details, sharing a login or code, or being pushed to act urgently. Those signs don’t depend on how the email reads.

Is AI-generated phishing really more effective?

Yes. The NCSC and the FBI have both warned that AI makes phishing more convincing and more personal, and the FBI has tied AI to tens of thousands of fraud complaints and hundreds of millions in losses. Cleaner, tailored messages get opened and clicked more often.

Will my spam filter stop AI phishing?

It will catch a lot, and you should keep it on. But a well-written, personalized email with no obvious bad link can still look legitimate to a filter, so don’t rely on it alone. A trained person is the backstop.

What should staff do if they aren’t sure about a message?

Slow down and check through a channel they trust, like calling a known number or asking the person directly. And report it, even if it turns out to be genuine.

Sources and further reading

•  NCSC: The near-term impact of AI on the cyber threat — the UK cyber agency on AI producing phishing lures without the usual spelling and grammar mistakes.

•  FBI IC3: Criminals Use Generative AI to Facilitate Financial Fraud — how criminals use AI-generated text and cloned voices, and how it removes the usual signs of fraud.

If you’d like help teaching your team what to watch for, or turning on phishing-resistant logins so a fooled password doesn’t turn into a break-in, your IT provider can set both up. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post How to Spot a Scam Email Now That They Look Real appeared first on Solve IT Solutions LLC.

If a cyberattack hits your business, what you do in the first hour really matters.

It’s also the easiest time to make a costly mistake, like turning off the wrong machine, deleting evidence, or replying from an email account the attacker is already reading.

The steps below tell you what to do, in order, so you’re not guessing in the moment.

Doing these steps doesn’t require technical knowledge.

Before anything else: don’t make it worse

Before you touch anything, avoid these:

• Don’t turn the affected computer off, if you can avoid it. Disconnecting it from the network is better, because powering it down can wipe evidence that helps work out what happened.
• Don’t delete anything. Leave the ransom note, the suspicious email, and any alerts exactly where they are. They’re what your IT team and investigators will need.
• Don’t pay a ransom on the spot.
• Don’t use the hacked email or accounts to talk about the attack. If an attacker is in your inbox, they can read those messages. Switch to phone calls or a different account.

The step by step

Work through these in order, starting the moment you notice something’s wrong.

1. Disconnect the affected devices from the network. Unplug the network cable and turn off Wi-Fi on anything that looks affected. This stops the problem spreading to other computers and to your backups. CISA’s guidance is to isolate devices rather than power them off where you can, and to shut a device down only if you can’t get it off the network any other way.
2. Call your IT provider straight away, by phone. Don’t email, in case the attacker is watching your inbox. If you have cyber insurance, call them next, because many policies require you to involve their incident team early.
3. Leave the evidence alone. Don’t wipe, reinstall, or tidy up the affected machines yet. Screenshots of the ransom note or suspicious emails are useful, but keep the originals too.
4. If money was sent, call your bank immediately. Ask them to recall the transfer and freeze it if they can. With wire and bank fraud, acting in the first few hours makes the biggest difference.
5. Reset passwords from a clean device, and turn on multi-factor authentication. Start with email and any admin accounts, and use a device you know isn’t affected.
6. Report it. That can help you recover, and it’s sometimes legally required. Where to report depends on your country.

Where to report it

You’ve reaWhere you report depends on where you are:

• United States: file with the FBI’s Internet Crime Complaint Center (IC3), and report to CISA.
• United Kingdom: report through the NCSC, and to Action Fraud.
• Australia: report through ReportCyber, or call the 24/7 hotline on 1300 CYBER1.

If money was wired to a scammer, report it fast.

The FBI says reporting wire fraud to IC3 within 72 hours gives its Recovery Asset Team the best chance of clawing it back, and that team recovers funds in about 70% of the cases reported in time.

If personal data about your customers or staff was exposed, you may be legally required to notify a regulator and the people affected, sometimes within 72 hours.

The rules depend on where you operate, like GDPR in the UK and Europe, state breach-notification laws in the US, and the Notifiable Data Breaches scheme in Australia.

Ask your lawyer or IT provider early so you don’t miss a deadline.

Should you pay the ransom?

If it’s ransomware, the big question is whether to pay.

The FBI does not recommend it. Paying doesn’t guarantee you get your files back, it marks you as a business that pays, and the money funds more attacks.

It’s ultimately your decision, but it’s one to make with law enforcement, your IT or incident-response team, and your insurer, not alone in the first panicked hour.

Sometimes a free decryption tool already exists for the exact ransomware that hit you, which is one more reason to get the experts involved before you pay anyone.

The best time to prepare is before it happens

All of this is far easier if you’ve decided some of it in advance. You don’t need a thick binder, just a simple plan that covers:

• Who to call first (your IT provider, your insurer) and their numbers, kept somewhere you can reach without your main systems.
• Where your backups are, and proof they’ve been tested by restoring from them.
• Which accounts and devices matter most, so you know what to protect first.

A single page covering those is enough for most small businesses, and it’ll save you a lot of scrambling if the day ever comes.

Frequently Asked Questions

What’s the first thing to do in a cyberattack?

Disconnect the affected devices from the network, by unplugging the network cable and turning off Wi-Fi, then call your IT provider by phone. Getting the device off the network stops the problem spreading while you get help.

Should I turn off the computer if I get ransomware?

If you can, disconnect it from the network instead of powering it off. Shutting it down can wipe evidence stored in memory that helps work out what happened. Only power a device off if you can’t get it off the network any other way.

Should I pay the ransom?

The FBI does not recommend it. Paying doesn’t guarantee you get your data back, and it funds more attacks. Make that decision with law enforcement, your IT or incident-response team, and your insurer, and check whether a free decryption tool already exists first.

We wired money to a scammer. What do we do?

Call your bank immediately and ask them to recall the transfer. If you’re in the US, report it to the FBI’s IC3 within 72 hours, because reported quickly, their Recovery Asset Team recovers the money in about 70% of cases. In other countries, contact your bank and your national reporting service straight away.

Who do I report a cyberattack to?

In the US, the FBI’s IC3 and CISA. In the UK, the NCSC and Action Fraud. In Australia, ReportCyber. Also tell your cyber insurer, and check whether you have a legal duty to notify a regulator if personal data was exposed.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post What to Do in Case of a Cyberattack (Step by Step) appeared first on Solve IT Solutions LLC.

Passwords are the weak point in most businesses.

People reuse them across accounts, write them on sticky notes, and type them into convincing fake login pages without realizing it.

Passkeys are the technology built to replace passwords, and they fix the parts that cause the most trouble.

A passkey lets you sign in with the same fingerprint, face scan, or PIN you already use to unlock your phone or laptop. There’s no password to type, so there’s nothing for an attacker to steal, guess, or trick out of you.

Let’s look at what passkeys are, why they’re so much harder to attack than passwords, and whether your business should start using them.

What is a passkey?

A passkey replaces your password with your device’s own security.

Instead of typing a password, you prove it’s you the same way you unlock your phone: a fingerprint, a face scan, or a PIN.

When you set up a passkey for a website, your device creates two matching keys.

The private key stays locked on your device and never leaves it.

The public key is stored by the website.

When you sign in, the site sends a challenge that only your private key can answer, your device answers it once you confirm with your fingerprint or PIN, and you’re in. The website never sees a password, because there isn’t one. This approach comes from a standard called FIDO, which Apple, Google, and Microsoft all build on.

Why passkeys are harder to attack than passwords

A password is a secret you share with the website every time you log in, and that’s exactly what attackers go after.

A passkey has no shared secret. That one difference fixes the biggest problems with passwords.

• They can’t be phished. A passkey only works on the real website it was created for. Land on a convincing fake, and the passkey simply won’t work, so there’s nothing to hand over. That matters, because phishing is how most break-ins start.
• There’s no password to steal in a breach. The website only keeps your public key, which is useless on its own. If the company gets hacked, there’s no password list to grab and try on your other accounts.
• Nothing to reuse or forget. Each passkey is unique to one site and made automatically, so reused and weak passwords stop being a problem.

Older methods like text-message codes and app approval prompts can still be tricked out of people.

Where you can use passkeys already

Support has spread fast.

You can already sign in with passkeys to Microsoft, Google, and Apple accounts, plus a growing list of banks, password managers, and business tools.

Apple, Google, and Microsoft have built passkeys into their phones, laptops, and browsers, so the device in your pocket can already store and use them.

There are two types worth knowing.

A synced passkey is backed up to your Apple, Google, or Microsoft account, so it works across all your devices and you’re covered if you lose one.

 A device-bound passkey stays on a single device, like a physical security key you plug in, which is the most locked-down option and a common pick for sensitive accounts.

Should your business use them?

For most businesses, yes, and you can start small. There’s no need to switch everything overnight or drop passwords on day one.

If you use Microsoft 365, passkeys are already available through Microsoft Entra.

Staff can sign in with a passkey stored in the Microsoft Authenticator app, a security key, or their own device. Google Workspace supports them too.

They’re also just faster. Microsoft says signing in with a synced passkey takes about 3 seconds, against roughly 69 seconds for a password plus a traditional MFA code. Across a whole team, that adds up.

Here’s how you can start using passkeys:

1. Turn passkeys on for your most sensitive accounts first: administrators, finance, and anyone who can move money or change systems.
2. Let everyone else add a passkey as a faster, safer way to sign in, alongside their normal login at first.
3. Make sure each person has a backup, like a second device or a security key, so a lost phone doesn’t lock anyone out.

Your IT provider can switch this on and run the rollout so nobody gets locked out along the way.

What to watch out for

Passkeys aren’t magic, and a few things are worth planning for.

• Account recovery. If someone loses the only device with their passkey and has no backup, they can get locked out. A synced passkey or a second registered device fixes this, but you have to set it up ahead of time.
• Not everything supports them yet. Support is growing fast, but some older systems and smaller vendors still rely on passwords, so you’ll run both side by side for a while.
• Shared devices and logins. Passkeys are tied to a person and their device, so any shared computers or shared accounts need their own plan.
•  

Frequently Asked Questions

What is a passkey in simple terms?

It’s a way to log in using your fingerprint, face, or PIN instead of a password. Your device proves it’s you to the website, and no password is ever typed or stored.

Are passkeys safer than passwords?

Yes. They can’t be phished, there’s no password for a hacker to steal in a data breach, and there’s nothing to reuse or forget. Security agencies like CISA recommend FIDO-based logins, which is what passkeys are, as the strongest widely available option.

What happens if I lose the device with my passkey?

If it was a synced passkey, it’s backed up to your Apple, Google, or Microsoft account and still available on your other devices. If it was device-bound and you have no backup, you’d use a recovery method to get back in, which is why setting up a second passkey or device in advance matters.

Does Microsoft 365 support passkeys?

Yes. Passkeys are available through Microsoft Entra at no extra cost, including the free tier. Staff can use a passkey in the Microsoft Authenticator app, a security key, or their device.

Do passkeys replace multi-factor authentication?

A passkey can count as multi-factor authentication on its own. Unlocking it needs both your device (something you have) and your fingerprint, face, or PIN (something you are or know), so it covers two factors in one step and can replace the old password-plus-text-code routine.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post What Are Passkeys, and Should Your Business Use Them? appeared first on Solve IT Solutions LLC.

Microsoft stopped supporting Windows 10 on October 14, 2025.

If your business is still running it, and plenty are, your computers aren’t getting security updates anymore.

Everything still turns on and works like normal, which is exactly why it’s easy to put off doing anything about it. The trouble is, the longer you stay on Windows 10, the more security holes pile up that nobody is ever going to fix.

So what does it mean for your business, and what are your options?

There are three: upgrade to Windows 11, pay for extended updates to buy some time, or replace the machine.

Let’s go through what you’re dealing with first.

What “end of support” means

When Microsoft ends support for a version of Windows, the updates stop. That includes the monthly security patches that fix newly found flaws.

Microsoft has confirmed that since October 14, 2025, Windows 10 gets no more security fixes, quality updates, feature updates, or technical support.

Your PCs don’t stop working. Nothing switches off the moment support ends. What’s different now is that Microsoft has stopped fixing Windows 10’s security flaws.

Attackers and security researchers keep finding new ones, and now nobody’s patching them. So every new flaw that turns up is another way into your computers, and it never gets fixed.

Why this is a real risk for your business

This is about more than an old, slow computer.

• They’re an easy target. Attackers go looking for computers running software that doesn’t get fixed anymore, because they know the flaws will just sit there. The UK’s National Cyber Security Centre points out that holes in unsupported products stay exploitable, often by fairly low-skilled attackers.
• You can fall out of compliance. If you handle card payments, health records, or personal data, rules like PCI DSS and HIPAA expect you to run supported, patched software. Windows 10 no longer counts, which can put you out of compliance.
• It can hit your cyber insurance. Insurers are asking more and more whether your systems are supported and patched. Running an unsupported operating system can push your premium up, shrink your coverage, or give the insurer a reason to fight a claim.
• Your other software will drop it. Over time, browsers, accounting tools, and other programs stop supporting Windows 10, so the apps you rely on every day can stop updating, or stop working altogether.

CISA puts running supported, updated software on its short list of basic security steps for businesses.

<H2>Your three options</H2>

You’ve really got three options, and most businesses end up mixing them across their computers.

1. Upgrade to Windows 11(free, if the hardware qualifies)

If you bought the PC in the last few years, upgrading to Windows 11 is free, and it’s usually the right move. The catch is the hardware. Windows 11 needs a supported processor, TPM 2.0, and Secure Boot, and that rules out a lot of older machines. To check whether a particular PC qualifies, run Microsoft’s free PC Health Check app.

2. Buy Extended Security Updates as a bridge

If a PC can’t move to Windows 11 yet, Microsoft will sell you Extended Security Updates (ESU) to keep the security patches coming for a while longer.

For businesses, that’s $61 per device for the first year, and it doubles every year after that, up to three years.

Keep one PC on Windows 10 the whole time and you’re looking at around $427 over those three years.

Home users get a much cheaper deal. A one-time $30 payment covers up to 10 devices with security updates through October 12, 2027, and it’s free if you sync your PC settings.

ESU gives you security patches and nothing else. No new features, no real tech support. It’s there to buy you time while you sort out the upgrade or a new machine.

3. Replace the PC

Some machines are just too old for Windows 11 and not worth paying ESU on year after year.

For those, buying a new PC that already runs Windows 11 usually works out cheaper, once you add up the ESU fees and the cost of keeping an old machine going.

How to plan the move

You don’t have to do all of this at once, but you do need a plan. A sensible order looks like this:

1. Make a list of every computer still on Windows 10.
2. Check which ones can move to Windows 11, using the PC Health Check app or your IT provider.
3. Upgrade the ones that qualify. It’s free, and it keeps your files and programs in place.
4. For the rest, choose between ESU to buy time or replacing the machine, depending on how old it is and what it’s used for.

Your IT provider can run that inventory quickly and tell you the best option for each machine.

Frequently Asked Questions

Is Windows 10 still safe to use after October 2025?

It still works, but it’s not getting security updates anymore, so the risk creeps up as new flaws are found and left unpatched. If you’re going to keep using it, either enroll in Extended Security Updates or plan your move to Windows 11.

What happens if I keep using Windows 10 and do nothing?

Your PCs will keep running, but they turn into an easier target for attackers, can put you out of compliance with payment and privacy rules, and may cause problems with your cyber insurance. And over time, the apps you depend on will start dropping Windows 10 too.

How much does Windows 10 ESU cost for a business?

For businesses, it’s $61 per device for the first year and doubles each year after that, up to three years, which comes to about $427 per device in total. Home users get a better deal: a one-time $30 payment covers up to 10 devices through October 12, 2027, or it’s free if you sync your PC settings.

Can my PC upgrade to Windows 11 for free?

If it meets the hardware requirements, yes. Windows 11 needs a supported processor, TPM 2.0, and Secure Boot. The PC Health Check app will tell you whether a specific machine qualifies, and PCs from the last few years usually do.

Should I just buy a new computer?

If a PC can’t run Windows 11, a new one is often cheaper than paying escalating ESU fees for years on top of running aging hardware. If it can upgrade, start with the free Windows 11 upgrade.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The post Still on Windows 10? Here’s Why You’re Putting Your Business at Risk appeared first on Solve IT Solutions LLC.