Toronto managed IT + cybersecurity for businesses. Practical support and security guidance. Learn more at https://nitter.gq/t.co/HjxxQAacag
Toronto, ON / GTA
Joined January 2010
- Tweets6.6K
- Following72
- Followers46
- Likes12
Pinned Tweet
Most “AI breaches” in SMB IT are still bad permissions with a better search box.
Messy guest access + wide SharePoint sharing, and Copilot surfaces it fast. That is the tenancy telling the truth.
Fix access first. Then turn AI features up.
116
Dental clinics: how do X-rays and referral notes get to the specialist?
If it's plain email, think about who else could end up reading it.
Microsoft 365 Business Premium puts an Encrypt button in Outlook. Make it the habit for anything with patient info.
Who's using it?
296
Lunch hour is when a lot of small-office phones ring out. At Group 4 Networks, Riley (our VocalStaff AI receptionist) picks up, sorts urgent from not, and writes up the rest.
vocalstaff.ai
21
Lawyers carry half their practice to court in a laptop bag.
So if that bag gets left on the GO train, is the drive encrypted?
With BitLocker on, it's a lost laptop. Without it, it's a lost laptop plus every client file on it.
Anyone actually checked theirs lately?
65
Retail owners: the internet drops on a busy Saturday and the card machines stop. Who calls the ISP, and do they know the account number?
Tape it inside the back office door. Account number, support line, who's allowed to call.
Saves a messy afternoon. Where's yours?
5
Insurance brokers working from home: is OneDrive syncing client files onto the family computer?
Someone signs in once to grab a policy doc, and now everything syncs to the PC the kids use too.
Microsoft 365 can block sync on devices you don't manage. Checked yours?
14
Medical and physio clinics: open the browser on a shared treatment room PC and look at its saved passwords.
Often it's everyone's logins. The booking system, the lab portal, someone's personal email.
Turn off password saving on shared PCs. When did you last check?
6
Myth: the warehouse tablet doesn't need MFA. It only runs receiving.
Reality: most of those tablets are signed into the same Microsoft 365 as AP and the quality docs.
If it walks out, so does a lot more than packing slips. Is yours exempt?
ALT Young male warehouse worker wearing glasses and a safety vest, holding a tablet in a busy aisle.
7
A text that looks like it came from the lab courier, asking for today's patient list "before 11." Would your clinic call back on a saved number first?
SecureAware runs SMS and voice phishing simulations for orgs up to ~300 users.
secureaware.app
9
Property managers: when a tenant moves out, does anyone change the amenity Wi-Fi password?
Most buildings keep the same one for years. Past tenants and old contractors still have it.
Who's still on that network after hours?
ALT Modern apartment building lobby lounge with a couch, chair, pendant lights, and plants.
9
Real estate brokerages: who actually owns your domain name?
A lot of the time it's on a past office manager's personal account and card. The card expires, the renewal fails, and email and the website go down the same day.
Do you know the login and the renewal date?
6
Hot take for accounting firms: Microsoft 365 is not your backup.
Someone deletes a client folder in SharePoint, nobody notices for a few months, and by then the recycle bin has emptied itself.
CRA wants records kept six years. Does your setup actually keep them?
ALT An accountant at a sunlit office desk using a calculator beside an open laptop and a stack of paperwork.
13
Nonprofit folks: that "quick favour, can you grab a few gift cards for donor thank-yous?" text from your executive director probably isn't from them.
Comes up a lot when the ED is travelling or at an event.
Simple rule: no gift card requests by text. Ever. Call to check.
ALT A staff member at a desk in a bright office looking at her smartphone with a laptop beside her.
18
Dental clinics: how many people know the front desk login?
Hygienists, the office manager, last summer's temp. Same password for years, no MFA because "it's shared."
Give everyone their own login. Someone leaves, you turn off one account.
Who still knows yours?
ALT Two staff members at the front desk of a bright, modern dental office reception
1
20
The "quick question" call is never quick when it lands mid-fix. At Group 4 Networks, Riley (our VocalStaff AI receptionist) takes the details, sends emergencies straight to a tech and queues the rest, written up.
vocalstaff.ai
91
Construction crews run on their phones. Drawings, site photos, company email, all on personal devices.
Then someone quits and it all walks off the job with them.
Microsoft 365 can wipe just the work apps and leave their family photos alone. Is that set up at your company?
ALT Smiling construction worker in a work vest crouching outside a building site, holding a smartphone
10
Law firms scan all day. And a lot of office copiers send those scans using one staff member's Microsoft 365 login.
That person changes their password or leaves, and scan to email quietly stops. Usually on a busy filing day.
Give the copier its own setup. Who set yours up?
ALT Person in a patterned shirt lifting the lid of a white office copier and tapping its touchscreen in a bright office
13
Architecture and engineering firms: open Microsoft Teams and look at your guest list.
Clients, consultants and subs added for one project tend to still be there years later, with access to that project's files.
Remove guests when the job closes. When did you last check yours?
ALT Two colleagues at a wooden table in a bright office reviewing a 3D house design on a laptop.
10
Retail owners, holiday orders are going out. Watch for a "supplier" email saying their banking details changed.
Same logo, same signature. Sometimes it's from their real mailbox, just hacked.
Before paying, call them on a number you already have. Has one hit your inbox yet?
ALT Shop owner in an apron working on a laptop at a table in a flower shop
14
Clinics: when an old front desk PC gets replaced, where does it go?
A storage closet. A staff member's kid. The curb. Often with years of patient info still on the drive.
Wipe it properly or have the drive destroyed, and note which machine and when. What happens to yours?
ALT Front desk receptionist in a bright medical clinic helping two patients with paperwork, with a desktop monitor on the counter.
11
A call that sounds exactly like your boss, asking for a quick payment before 3. Would your team call back on a saved number first?
SecureAware runs SMS and voice phishing simulations for orgs up to ~300 users.
secureaware.app
20