Microsoft began shutting off Exchange Web Services in Microsoft 365 on October 1, 2026. Many older backup, archiving, CRM, and email signature tools still depend on that connection. Basic username and password sign-in for scan to email copiers is also scheduled to be turned off by default at the end of December. In this episode, Jason Russell explains what is changing in plain English, why these failures tend to happen without anyone noticing, and how to get ahead of them this week.

• The EWS shutdown is phased. It started October 1, 2026, and ends permanently on April 1, 2027.
• Silent failures are the real risk. A backup or archive that stops collecting email may not give you an obvious warning.
• Scanners and copiers are next. Devices that send scans by email with a plain username and password need a modern sign-in method or a different setup.
• Make a list. Write down every outside tool and device that sends, reads, stores, or changes your company email.
• Ask every vendor two questions. Ask how their product connects to Microsoft 365 and how you will know if that connection stops working.

Sources

• Microsoft Exchange Team Blog: Exchange Online EWS, Your Time Is Almost Up
• Office Watch: October 2026 Office Changes
• AdminDroid: Microsoft 365 End of Support Milestones
• Manuel T. Gomes Newsletter: Get Ready for a Busy October

On September 1, 2026, the FBI's Internet Crime Complaint Center published a public service announcement titled Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing. In this episode, Jason Russell explains in plain English how a fake app can ask an employee for permission to read their mailbox or files, and why multifactor authentication does not stop it on its own. He also walks through the Microsoft 365 and Google Workspace settings that let an administrator approve app permissions before staff can grant them.

Key takeaways

• Consent phishing does not steal a password. It tricks a user into granting a malicious app permission to their account through a real Microsoft or Google sign-in page.
• Multifactor authentication still matters, but once an app has been granted access it can keep reading data without triggering new sign-in prompts, and a password change may not remove that access.
• In Microsoft 365, administrators can restrict user consent and turn on an admin approval workflow. In Google Workspace, administrators can restrict unconfigured third-party apps through API controls.
• Review the list of apps that already have access to your company accounts and remove anything you do not recognize.
• If someone clicked Accept on a suspicious app, revoke the app's access, check for unusual mailbox rules, and report the incident to the FBI's Internet Crime Complaint Center.

Sources

• FBI Internet Crime Complaint Center, Public Service Announcements

Most breaches don’t need a genius. They need a flaw that already has a fix, at a business that hasn’t installed it yet. Jason Russell follows a made-up Central Florida accounting firm whose firewall sat unpatched for two months, right up to the week before the tax deadline, then shows the boring habits that would have made the attack a non-event.

Along the way: why a published fix is also a map for criminals, why small businesses fall behind, and the free government list that tells you what to patch first.

In this episode

• The most common way in. Exploited software flaws were the top entry point in 31% of breaches in Verizon’s 2026 report and 32% of intrusions in Mandiant’s M-Trends 2026.
• The speed problem. Mandiant estimates attackers now exploit flaws about seven days before a fix is even released, on average.
• Most businesses are behind. Only 26% of actively exploited flaws were fully fixed, and the median fix took 43 days.
• Why patching gets skipped. Fear of breaking things, nobody owning it, forgotten devices, vendor software, and equipment that no longer gets fixes.
• Four habits that fix it. Know what you have, let automatic updates handle the easy stuff, put the firewall and network gear on a calendar, and patch what’s under attack first.
• CISA’s patch-this-first list. What the Known Exploited Vulnerabilities catalog is, how to get free alerts, and the two questions to ask your IT provider.

Your one thing this week: take a picture of every box with a blinking light in your network closet, and find out when each one last got an update.

Chapters

• 0:00 Intro
• 0:10 Three days before the tax deadline
• 1:06 What a patch is, and why it’s also a map
• 2:04 Why patching matters
• 4:12 How the firm got breached
• 5:08 Why small businesses skip it
• 7:06 Four habits that make it routine
• 9:31 The patch-this-first list
• 11:07 The same story, done right
• 12:16 Your one thing this week
• 12:32 How to reach Jason

Mentioned in this episode

• Episode 3: How to Vet a Managed IT Provider
• Episode 4: Don’t Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)
• Episode 5: Ransomware, Explained Without the Jargon
• CISA Known Exploited Vulnerabilities Catalog

Sources

• Verizon, 2026 Data Breach Investigations Report
• Google Cloud / Mandiant, M-Trends 2026
• Sophos, The State of Ransomware 2026
• Coveware by Veeam, Q2 2026 Quarterly Report
• CISA, Known Exploited Vulnerabilities Catalog

Want help building your equipment list?

Email Jason directly at jason@harmony-msp.com. Send him your network closet photos, and he’ll help you figure out what’s overdue and what to fix first.

Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

Ransomware rarely hits in one bad click. It's closer to a burglary that takes weeks, and every one of those weeks is a chance to stop it. Jason Russell follows a made-up Central Florida dental practice through a realistic attack, from one stolen password to a locked office on a Monday morning, then shows what would have changed the ending.

Along the way: why attackers mostly log in instead of breaking in, why the ransom usually isn't the biggest bill, and what paying actually buys you.

In this episode

• The four stages of an attack. Get in, look around, take, lock, and why 79% of attacks in Sophos's 2026 survey started with someone's login.
• The forgotten door. Among victims whose attack began with a stolen password, 97% had MFA turned on somewhere. Somewhere is the problem.
• What it really costs. Median recovery cost was $375,000 before any ransom, and the average recovery took three weeks.
• The HIPAA angle. Why HHS presumes ransomware on patient data is a reportable breach, and what that means for medical and dental practices.
• Should you pay? Why the FBI says no, and what law enforcement found when it took down LockBit.
• What actually stops it. MFA on every login, someone watching around the clock, backups that can't be deleted, and a plan on paper.

Your one thing this week: list every way someone can log in to your business from the outside, and find out which ones don't have MFA.

Chapters

• 0:00 Intro
• 0:10 A Monday morning at a dental practice
• 1:06 Ransomware in plain English
• 2:00 Too small to be a target?
• 2:37 How an attack unfolds
• 5:30 What it really costs
• 7:14 Should you pay?
• 8:12 What actually stops it
• 11:27 The same story, done right
• 12:18 Your one thing this week
• 12:49 How to reach Jason

Mentioned in this episode

• Episode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy
• Episode 4: Don't Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)

Sources

• Sophos, The State of Ransomware 2026
• Coveware by Veeam, Q2 2026 Quarterly Report
• Verizon, 2026 Data Breach Investigations Report
• FBI, Ransomware
• HHS, Fact Sheet: Ransomware and HIPAA
• FBI Internet Crime Complaint Center (report an attack)

Want a second set of eyes on your login list?

Email Jason directly at jason@harmony-msp.com. Send him the list, and he'll help you find the doors you forgot about.

Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

Without any special tools and without breaking into anything, a stranger can send an email that appears to come from your business. Your domain in the From line. A short, reasonable request: pay this invoice, or update the account we send payments to. Your client opens it, because why wouldn't they.

In this episode, Jason Russell walks through why email was built this way, and the three DNS records that make spoofing much harder to pull off: SPF, the list of servers allowed to send for your domain; DKIM, the tamper-proof signature on every message; and DMARC, the rule that ties them together and tells receiving servers what to do when something fails.

Then the part most businesses miss. DMARC has three policy settings, and the most common mistake is stopping at the first one. A domain sitting at p=none gets you reports about being spoofed — not protection from it. CISA treats that setting as a temporary step toward reject, not a finish line.

The episode closes with what these records genuinely cannot stop: lookalike domains and display-name spoofing, both of which show up constantly in wire fraud aimed at law firms and title companies. Records handle the easy version of the attack. A verification habit handles the rest.

You'll finish this one knowing exactly what to ask your IT provider, and how to tell whether the answer you get is a real answer.

In this episode

• (0:00) Why someone can send mail in your name right now
• (1:40) The envelope analogy: why email never verified senders
• (3:30) SPF — the list of who's allowed to send
• (5:00) DKIM — the signature that proves nothing was altered
• (6:15) DMARC — the rule that ties it together
• (8:15) The p=none trap, and why it isn't protection
• (10:00) What these records don't stop: lookalike domains and display-name spoofing
• (12:00) Why this matters even if you barely send email
• (13:30) The three-step rollout, in order
• (15:00) What to do this week

Key takeaways

• Email doesn't verify senders on its own. Your domain is forgeable until you configure it otherwise.
• SPF lists authorized servers, DKIM signs messages, DMARC decides what happens on failure and reports who's using your domain.
• p=none is monitoring, not protection. Real protection starts at quarantine and lives at reject.
• Free checkers confirm records exist — not that they're configured correctly, which is where most problems hide.
• Neither DMARC nor anything else catches lookalike domains or display-name spoofing. Verify payment changes by phone, using a number you already have.

Resources

• Companion article: How to Stop Someone From Sending Email in Your Company's Name — https://harmony-msp.com/how-to-stop-someone-from-sending-email-in-your-companys-name/
• CISA Binding Operational Directive 18-01, Enhance Email and Web Security — https://www.cisa.gov/binding-operational-directive-18-01
• Google Email Sender Guidelines FAQ — https://support.google.com/mail/answer/14229414
• Microsoft, "Strengthening the Email Ecosystem: Outlook's New Requirements for High-Volume Senders" — https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730
• Law firm IT and security — https://harmony-msp.com/industries-we-serve/law-firm/
• Medical and dental practice IT and security — https://harmony-msp.com/industries-we-serve/medical-dental-practices/