Blog

On October 20, 2026, several major banks in the United Kingdom experienced disruptions to their online services.Customers had trouble accessing banking applications and completing everyday transactions. Behind the scenes, the problem wasn't necessarily with the banks' own systems.A power failure had affected part of Google Cloud's infrastructure in London.The disruption lasted approximately six hours, affecting multiple cloud services and organizations that depended on them.Google's engineers worked to restore service. But for the businesses relying on that infrastructure, there was only so much they could do while waiting.And that's where this story becomes relevant to almost any business today.What happens when the technology your business depends on stops working, but the problem is completely outside your control?<h3>The Cloud Has Changed How Businesses Operate </h3>For many small and midsize businesses, moving to the cloud has been a positive change.Employees can access applications from different locations. Companies no longer need to maintain as much infrastructure themselves. Updates, maintenance, and many technical responsibilities are handled by specialized providers.It's easy to understand why businesses have embraced this approach.But there's a dependency that can be overlooked.When a business moves its email, accounting, customer management, or other essential systems to the cloud, those systems still depend on physical infrastructure somewhere.And that infrastructure can fail.The October 20 incident is a reminder that even major technology providers, with sophisticated infrastructure and extensive resources, cannot guarantee uninterrupted availability.<h3>When One Problem Affects Several Services </h3>Consider how many everyday business activities now depend on cloud applications.A sales team needs its customer management system to follow up on opportunities. Accounting needs access to financial records. Employees depend on shared documents, communication platforms, and online applications.These services may appear separate to the people using them.But behind the scenes, some may depend on the same infrastructure or interconnected providers.When that shared dependency experiences problems, several business functions can be affected at once.The immediate concern isn't necessarily lost information.It's the inability to work.Employees may spend time repeatedly attempting to access applications. Managers may not know whether the issue is internal or widespread. Customers may be waiting for answers that the business cannot immediately provide.And while everyone is trying to understand what happened, normal operations slow down.<h3>Your IT Provider May Not Be Able to Fix the Outage </h3>This is one of the more uncomfortable realities of cloud computing.A business can have properly maintained computers, a reliable network, and responsive IT support, yet still experience downtime because an external service is unavailable.Your IT provider cannot repair a power failure inside a major cloud provider's data center.But that doesn't mean there is nothing useful IT support can do.A prepared IT team can help determine whether the issue is local or external, identify which services are affected, communicate what is known, and help employees use available alternatives.More importantly, much of that preparation should happen before an outage.Because when a critical application suddenly becomes unavailable, that's a difficult time to begin figuring out which business processes depend on it.<h3>The Question Isn't Whether the Cloud Is Reliable </h3>Cloud platforms remain valuable for businesses of almost every size.The lesson from this incident isn't that companies should abandon cloud services or return everything to local servers.It's that reliability and business continuity are not exactly the same thing.A cloud provider may have excellent availability over the course of a year. But if an interruption happens during an important business activity, even a few hours can create serious operational challenges.The more useful question is whether the business has considered what happens during those hours.For example:<ul><li>Which applications would immediately prevent employees from doing their jobs?</li><li>Are there essential tasks that could continue temporarily without those applications?</li><li>Who determines whether an outage is internal or related to a service provider?</li><li>How will employees and customers receive updates?</li><li>What needs to happen before normal operations can safely resume? </li></ul>Not every business needs expensive redundant infrastructure or complicated disaster recovery systems.Sometimes the most practical improvements involve documented procedures, clear responsibilities, and a realistic understanding of which activities can and cannot continue.<h3>Backups Are Important, but They Don't Solve Every Interruption </h3>Businesses often associate continuity planning with backups.And backups are essential when information is deleted, damaged, or otherwise needs to be recovered.But a backup doesn't necessarily help employees access a cloud application when the provider itself is unavailable.That distinction matters.Having a copy of your information is different from having a practical way to continue operating while the system that normally processes that information is offline.This is why business continuity planning needs to consider more than data protection.It should also address people, processes, dependencies, communication, and recovery priorities.We explore that distinction further in our article, <a data-mce-href="https://nivo5.com/blog/why-business-continuity-is-more-than-having-backups" href="https://nivo5.com/blog/why-business-continuity-is-more-than-having-backups" title="Why Business Continuity Is More Than Having Backups" target="_blank" rel="noopener">Why Business Continuity Is More Than Having Backups</a>.<h3>What Would Your Business Do for Six Hours? </h3>The Google Cloud incident eventually ended, and affected services recovered.But the bigger question remains.If a critical cloud application became unavailable tomorrow morning, would your employees know whether to wait, switch to an alternative process, or contact someone for guidance?Would your business know which operations could continue and which would have to stop?These aren't questions that require a major technology investment to begin answering.They require understanding how your business actually works and where its technology dependencies exist.Because the goal isn't to promise that interruptions will never happen.It's to make sure an interruption doesn't leave everyone wondering what to do next.

When the Cloud Goes Down, Who Keeps Your Business Running?

A message arrives from someone who appears to represent one of your suppliers. The conversation looks normal. The name is familiar, the language is professional, and the request seems consistent with an existing business relationship.Perhaps they need to confirm a change to payment details. Perhaps they are asking an employee to share a document or approve an account change.Nothing immediately seems unusual.But how does the employee know that the person on the other side of the conversation is actually who they claim to be?This question is becoming increasingly important as artificial intelligence makes impersonation easier to create and more difficult to recognize.<h3>The Problem Is Moving Beyond Email </h3>For years, businesses have been encouraged to watch for suspicious emails, unexpected attachments, unfamiliar links and obvious spelling mistakes.Those precautions still matter. However, business communication now takes place across multiple channels.Employees use collaboration platforms, messaging applications, video meetings and phone calls to communicate with colleagues and external contacts. Suppliers, contractors and service providers may also interact with employees through these same channels.This creates opportunities for attackers to exploit something businesses often take for granted: familiarity.A message arriving through a platform employees use every day can feel more trustworthy than an unexpected email. A recognizable name or profile picture can reinforce that impression.Artificial intelligence adds another dimension. It can help criminals produce convincing messages, imitate someone's communication style and generate synthetic audio or video that makes impersonation increasingly believable.The challenge is no longer simply recognizing suspicious messages. It is establishing whether the person making a request is who they claim to be and has the authority to make it.<h3>Security Protections Are Expanding Across Business Communication </h3>The growing concern is reflected in changes to the security features of business communication platforms.Microsoft, for example, is expanding the protections available within Teams to address different types of suspicious communication.For external text conversations, Teams can display warnings when it detects potential spam, phishing or impersonation. Microsoft has also announced AI-powered, context-aware phishing detection designed to identify suspicious behavior in conversations, including situations where a malicious message may not contain an obvious link or attachment.Voice calls have their own protection.Microsoft Teams Calling includes Brand Impersonation Protection, which evaluates incoming VoIP calls from first-contact external callers for signs that someone may be impersonating a trusted organization. When a potential impersonation is detected, users can receive a warning before answering. Warnings may also appear during a call if suspicious signals persist.These developments also illustrate why businesses need a broader approach to cybersecurity. As we explain in <a data-mce-href="https://nivo5.com/blog/why-small-business-cybersecurity-requires-more-than-antivirus" href="https://nivo5.com/blog/why-small-business-cybersecurity-requires-more-than-antivirus" title="Why Small Business Cybersecurity Requires More Than Antivirus" target="_blank" rel="noopener">Why Small Business Cybersecurity Requires More Than Antivirus</a>, protecting a business requires more than individual security tools. Identity verification, access controls and clear procedures all play an important role in reducing risk.This is particularly relevant because impersonation does not always begin with an email or text message. An attacker may attempt to establish trust through a telephone conversation instead.<h3>What About Teams Phone Numbers? </h3>There is an important distinction between Teams-to-Teams calls and calls made through Teams Phone using the public telephone network.Businesses using Microsoft Teams Phone can make and receive calls through regular telephone numbers using Calling Plans, Operator Connect or Direct Routing.Microsoft provides spam filtering for incoming Public Switched Telephone Network (PSTN) calls. When a call is considered potentially unwanted, Teams can display a notification such as "Spam Likely."However, this is not the same as Brand Impersonation Protection.PSTN spam filtering identifies potentially unwanted calls based on spam-detection signals. It should not be interpreted as an equivalent system for detecting deepfake voices or determining whether someone is impersonating a particular business or individual.In practical terms, an incoming external Teams VoIP call may receive a brand-impersonation warning, while an incoming call to a Teams Phone number from the regular telephone network may receive a spam warning.Neither provides a guarantee that every fraudulent caller will be identified.These distinctions matter because businesses should understand exactly what their communication security features protect against rather than assuming that all calls passing through the same application receive identical protection.<h3>AI Makes Familiarity a Less Reliable Security Signal </h3>The concern extends beyond written communication.In September 2026, Gartner published findings from a survey of 297 senior cybersecurity leaders. Forty-one percent reported at least one social-engineering incident involving a deepfake during an employee audio call in the previous 12 months. Thirty-six percent reported an incident involving a video call.These findings illustrate why businesses should reconsider how much confidence they place in recognizing someone's voice or seeing their face during a conversation.An employee may believe they are speaking with a manager, business partner or supplier. Yet familiarity alone cannot establish identity.The consequences can be significant when a request involves financial transfers, changes to payment instructions, access to business systems, sensitive information or account recovery.The issue is not simply whether a message or conversation looks convincing. It is whether the business has a process for confirming the identity and authority of the person making the request.<h3>Verification Should Not Depend on Recognizing a Fake </h3>One of the most practical changes a business can make is to stop expecting employees to identify every possible impersonation attempt.That is an increasingly difficult expectation when messages, voices and video can all be manipulated.Instead, verification should be built into normal business procedures for handling requests with significant consequences.For example:<ul><li>Payment changes should be confirmed through an independently established contact method, rather than simply by replying to the message or calling the number included in the request.</li><li>Requests to reset accounts, change permissions or disclose sensitive information should follow established authorization procedures.</li><li>Unexpected instructions from executives or external business partners should be verified through a separate, trusted communication channel.</li><li>Employees should have a clear way to report suspicious requests without feeling pressured to act immediately. </li></ul>The important distinction is between trusting the communication and verifying the request.A familiar platform, a recognizable name or a convincing voice should never be the sole reason an employee approves a sensitive action.<h3>Security Is Also a Business Process </h3>Technology can help identify suspicious activity, block malicious communication and provide additional warnings. These protections are valuable, but they cannot replace appropriate business procedures.Organizations also need to determine what happens when a request reaches an employee.Who is authorized to approve a payment change? How should a supplier's new banking details be verified? What happens when someone requests access to an account or asks for sensitive information?These questions need clear answers before an unexpected request arrives.The objective is not to make everyday communication difficult or to require employees to question every conversation.It is to introduce appropriate verification at the points where a mistake could have serious consequences.As AI makes impersonation more convincing, businesses cannot rely exclusively on employees recognizing suspicious communication or on security warnings appearing at the right moment.They need processes that establish identity and authority independently of the communication channel being used.The question business owners should be asking is simple: If someone convincingly impersonates a person their employees already trust, what would prevent that request from being carried out?

When a Familiar Voice or Message Is No Longer Proof of Identity

On October 21, 2026, thousands of cloud servers in Japan were caught up in a cybersecurity incident that forced a technology provider to suspend services.For businesses relying on those systems, the disruption presented a difficult reality.Their technology was hosted and maintained by an external provider. Yet when something went wrong inside that provider's environment, customers were left waiting for answers about when they could safely resume operations.Up to 26,739 servers were potentially affected.The incident raises an important question for businesses everywhere:What happens when the company responsible for keeping your systems available becomes the reason you cannot access them?<h3>A Security Incident Becomes an Operational Problem </h3>The provider discovered unauthorized access and malicious software affecting part of its cloud environment.To prevent further damage, it suspended services while investigating the incident.From a security perspective, shutting down potentially compromised systems can be necessary.But from a customer's perspective, the consequences can be immediate.Imagine an accounting team unable to access its hosted applications during a reporting deadline. Or employees who rely on remote desktops suddenly finding themselves unable to work.These are illustrative situations, not confirmed outcomes of this particular incident. But they demonstrate why a technical problem at a service provider can quickly become a business problem.Customers may have done everything expected of them. Their subscriptions were active, their devices were functioning, and their internet connections were working.Yet access to essential systems could still disappear.<h3>When the Investigation Creates More Questions </h3>As the investigation progressed, the provider confirmed that customer information had been taken.Reports of unauthorized transactions involving accounts accessed through the service added another concern.Then came threats involving the publication of stolen information and a possible ransomware attack.By October 27, customers were being advised to back up their information, disconnect computers from the network, and shut them down as a precaution.The provider subsequently confirmed that information claimed to belong to customers had been published, while the investigation continued.For affected organizations, the challenge was no longer simply waiting for systems to come back online.They also needed to consider whether their information, accounts, and connected devices could still be trusted.Restoring a service and restoring confidence in that service are not necessarily the same thing.<h3>The Hidden Risk of Depending on One Provider </h3>Cloud technology offers genuine advantages.Businesses can access applications remotely, reduce their physical infrastructure, and rely on specialized providers to maintain systems that would otherwise require substantial internal resources.But convenience can conceal dependencies.A business may have reliable internet, properly maintained computers, and well-trained employees while still depending entirely on one external service for a critical operation.When that service becomes unavailable, the organization may have no immediate alternative.This is where business continuity becomes more than an IT discussion.It becomes a question of which activities must continue, which can temporarily stop, and how long the organization can realistically operate without a particular system.A provider's responsibility to maintain its infrastructure does not eliminate a customer's responsibility to prepare for an interruption.<h3>What Businesses Should Consider Before an Incident </h3>The answer isn't necessarily to abandon cloud services or duplicate every system.That would be expensive and, in many cases, unnecessary.Instead, businesses should understand which external dependencies matter most.Start with a few practical questions:<ul><li>Which applications would seriously disrupt operations if unavailable for an entire business day?</li><li>Can essential information be recovered independently of the affected provider?</li><li>Is there an alternative way for employees to complete critical work?</li><li>Who coordinates decisions and communication when a provider reports a security incident?</li><li>Have backup restoration and alternative workflows actually been tested? </li></ul>These questions help distinguish ordinary technology inconveniences from interruptions that could affect revenue, customer commitments, or essential operations.For some businesses, the answer may involve independent backups. For others, documented manual procedures, alternative communications, or a recovery arrangement may be more appnropriate.The important part is understanding the dependency before it becomes urgent.<h3>The Bigger Lesson </h3>The investigation into the October incident is still developing.But one lesson is already clear.A business can outsource the management of its technology without outsourcing the consequences of losing access to it.That doesn't make cloud technology unreliable. It makes planning for interruptions essential.A useful business continuity strategy considers not only what happens when internal equipment fails, but also what happens when trusted external services become unavailable.For a deeper look at this distinction, read our related article, <a data-mce-href="https://nivo5.com/blog/why-business-continuity-is-more-than-having-backups" href="https://nivo5.com/blog/why-business-continuity-is-more-than-having-backups" title="Why Business Continuity Is More Than Having Backups" target="_blank" rel="noopener" data-mce-selected="inline-boundary">Why Business Continuity Is More Than Having Backups</a>.At Nivo 5, we help businesses evaluate their technology dependencies, identify operational risks, and plan for disruptions before they affect everyday work.If one of your most important technology providers became unavailable tomorrow, would your business know what to do next?

When Your Cloud Provider Becomes the Business Disruption

On October 21, 2026, several government websites in the Netherlands were temporarily taken offline.Not because their servers had failed. Not because an attack had been confirmed.They were taken offline as a precaution.Security authorities had warned about two critical vulnerabilities in PHP, a technology used behind the scenes by many websites and online applications. The weaknesses could potentially allow attackers to take control of vulnerable servers.The Dutch National Cyber Security Centre temporarily disabled its own website. Other government services took similar precautions while security updates were being prepared.It was an unusual situation. Organizations responsible for providing important public services had to decide whether keeping their websites available was worth the potential risk.And that raises an uncomfortable question for any business.What happens when the technology your business depends on suddenly becomes a potential liability?<h3>The Problem Wasn't Just the Vulnerability </h3>Most business owners have little reason to know which programming language runs their website.They expect their website to work, customers to access their services, and their technology providers to handle maintenance.That's a reasonable expectation.But when a serious vulnerability is announced, the conversation changes quickly.Is our website affected?Has someone already addressed the problem?Can we continue operating safely?And perhaps most importantly, who is responsible for making that decision?During the October incident, security updates became available, and organizations were advised to apply them promptly.But installing an update is only one part of the response.Someone first has to know which systems are affected, who manages them, whether the update could interfere with existing applications, and how to confirm that the vulnerability has actually been addressed.For a business without clearly defined technology responsibilities, those questions can take longer to answer than expected.<h3>When Staying Online Becomes a Business Decision </h3>Taking a website offline may sound like an extreme precaution.For some organizations, however, temporarily interrupting a service may be preferable to leaving a critical vulnerability exposed while a fix is being arranged.That decision becomes more complicated when the website supports everyday business activities.An online store may depend on customer orders. A professional services firm may use a portal to exchange documents. Another business may rely on an online scheduling system.Temporarily disabling any of these services can create immediate operational problems.But continuing to operate without understanding the exposure carries a different kind of risk.A security warning is not simply a technical problem. It creates a business decision involving risk, operational continuity, potential costs, and information that may still be incomplete.Without an established decision-making process, even a reasonable precaution can become difficult to evaluate, approve, and communicate.There isn't always a comfortable choice.The important distinction is whether the business is making an informed decision or simply hoping someone else has already handled the problem.<h3>Who Is Actually Watching the Technology? </h3>A business may have a website developer, a hosting provider, an internal IT contact, and an external support company.Each may be doing exactly what they were hired to do.Yet responsibility for responding to a critical vulnerability can still fall between them.The hosting provider may maintain the server but not the application. The website developer may maintain the application but assume the hosting provider handles system updates.Meanwhile, the business owner assumes everything is covered.Nobody necessarily acted irresponsibly. The problem may be that responsibility was never clearly established.And during an urgent security event, discovering that gap can become a problem of its own.This is why understanding the technology behind a business matters even when everything appears to be working normally.Not because owners need to become technical experts, but because someone needs to maintain visibility into the systems the business relies on.<h3>What Businesses Can Learn From This Incident </h3>The PHP vulnerabilities were a specific technical problem. The questions they exposed apply much more broadly.A serious vulnerability could emerge in a website, business application, network device, or another service employees depend on.The practical response begins before that warning arrives.Businesses should be able to establish:<ul><li>Which important systems and online services they depend on.</li><li>Who is responsible for monitoring security advisories and maintaining each system.</li><li>Who has authority to approve emergency changes or temporary interruptions.</li><li>How updates are tested, applied, and verified.</li><li>What alternative arrangements exist if a critical service must be temporarily unavailable. </li></ul>These responsibilities don't necessarily require a large internal IT department. They do require clear ownership and coordination with the appropriate providers.And when a vulnerability is discovered, applying the available fix is not the same as confirming the entire response is complete.Someone still needs to verify the affected systems, confirm that updates were successful, and determine whether additional investigation is necessary.<h3>The Question Worth Asking Before the Next Warning </h3>The October PHP incident did not mean every website using the technology had been compromised. Dutch authorities subsequently reported that exploitation was complex and that a reported possible attack had not been confirmed successful.Nevertheless, the situation was serious enough for organizations to interrupt public services while addressing the risk.That is what makes the incident worth examining.A business can have antivirus protection, backups, firewalls, and reliable IT support, yet still struggle when an unexpected vulnerability requires an immediate operational decision.This incident illustrates a broader business challenge: important technology decisions become much harder when responsibilities, risks, and response procedures have not been established in advance. As we explore in <a data-mce-href="https://nivo5.com/blog/the-risks-of-making-technology-decisions-without-a-clear-plan" href="https://nivo5.com/blog/the-risks-of-making-technology-decisions-without-a-clear-plan" title="The Risks of Making Technology Decisions Without a Clear Plan" target="_blank" rel="noopener">The Risks of Making Technology Decisions Without a Clear Plan</a>, preparation helps businesses make informed choices when unexpected problems arise, rather than being forced to improvise under pressure.The next critical warning may involve something entirely different from PHP.If it affected a system your business depends on tomorrow, would you know who was handling it, what decisions needed to be made, and how you would know the problem had been resolved?That's a conversation worth having before the warning arrives.

When a Security Warning Leaves Businesses With a Difficult Decision

An employee receives a call from someone claiming to be the company's IT support team.There is a security update that needs attention. The caller explains that the employee's account requires a new authentication setup and offers to walk them through the process.It sounds like a routine technology request.The employee may already be familiar with multifactor authentication, commonly called MFA. They have probably been told that approving security prompts, registering authentication methods, and following IT instructions are important parts of protecting company information.So why would this particular request seem suspicious?That question sits at the center of a growing cybersecurity problem: attackers are finding ways to make fraudulent instructions look like legitimate security procedures.<h3>When Following Instructions Becomes the Risk </h3>This is not simply a hypothetical concern.In a 2026 advisory, the Canadian Centre for Cyber Security described incidents in which attackers manipulated support personnel into resetting MFA or registering devices controlled by attackers.The advisory highlighted a troubling weakness. Attackers were not necessarily exploiting sophisticated software vulnerabilities. They were exploiting the trust businesses place in their identity verification and support processes.Consider what that means for a smaller organization.An employee might receive a message about an account problem, a required security update, or a new login procedure. The person contacting them may sound knowledgeable and use terminology that employees regularly hear from legitimate IT support.The employee's intention is to cooperate.The attacker wants that cooperation to result in unauthorized access.The problem is not that employees are unwilling to follow security procedures. It is that criminals can imitate those procedures.This is why <a data-mce-href="This%20is%20why%20everyday%20employee%20habits%20affect%20business%20security%20in%20ways%20that%20go%20beyond%20recognizing%20suspicious%20emails.%20Employees%20also%20need%20to%20understand%20how%20to%20verify%20unexpected%20requests%20involving%20their%20accounts%20and%20access." href="This%20is%20why%20everyday%20employee%20habits%20affect%20business%20security%20in%20ways%20that%20go%20beyond%20recognizing%20suspicious%20emails.%20Employees%20also%20need%20to%20understand%20how%20to%20verify%20unexpected%20requests%20involving%20their%20accounts%20and%20access." title="How Everyday Employee Habits Affect Business Security" target="_blank" rel="noopener">everyday employee habits affect business security</a> in ways that go beyond recognizing suspicious emails. Employees also need to understand how to verify unexpected requests involving their accounts and access.<h3>Why MFA Alone Cannot Solve This Problem </h3>MFA remains an important protection for business accounts.Requiring additional verification beyond a password makes unauthorized access more difficult. Stronger authentication methods, particularly phishing-resistant options, can provide significantly better protection against common credential theft techniques.But authentication technology is only one part of the process.Businesses also need procedures for enrolling devices, resetting authentication methods, recovering locked accounts, and helping employees who cannot sign in.Those activities sometimes require human assistance.And that creates opportunities for manipulation.An attacker might persuade someone to approve an unexpected authentication request, disclose a verification code, or initiate a fraudulent account recovery process.In other cases, the attacker may target the help desk itself, attempting to convince support personnel to register an unauthorized authentication method.These are different techniques, but they expose the same operational weakness: the organization may not have a reliable way to verify who is requesting or authorizing an account change.<h3>The Business Impact Goes Beyond One Employee </h3>A compromised account is rarely just an isolated technical issue.Depending on the employee's permissions, an unauthorized person might gain access to company email, shared documents, customer information, or internal business applications.This also raises a broader question about <a data-mce-href="This%20also%20raises%20a%20broader%20question%20about%20who%20really%20has%20access%20to%20your%20business%20information.%20Understanding%20account%20permissions%20and%20reviewing%20access%20regularly%20can%20help%20businesses%20recognize%20the%20potential%20consequences%20when%20an%20employee%20account%20is%20compromised." href="This%20also%20raises%20a%20broader%20question%20about%20who%20really%20has%20access%20to%20your%20business%20information.%20Understanding%20account%20permissions%20and%20reviewing%20access%20regularly%20can%20help%20businesses%20recognize%20the%20potential%20consequences%20when%20an%20employee%20account%20is%20compromised." title="Who Really Has Access to Your Business Information?" target="_blank" rel="noopener">who really has access to your business information</a>. Understanding account permissions and reviewing access regularly can help businesses recognize the potential consequences when an employee account is compromised.That access can create further problems.A business may need to investigate suspicious activity, review account permissions, revoke unauthorized sessions, and determine whether information was accessed or changed.Employees may temporarily lose access to systems while the situation is investigated.If the compromised account belongs to someone responsible for finance, administration, or sensitive customer relationships, the disruption could become particularly significant.The consequences depend on what the account can access and what the attacker actually does.But even without a confirmed data breach, uncertainty about account integrity can interrupt normal operations.For business owners, this raises a practical question:Would your company know what to do if an employee reported that someone claiming to be IT had asked them to change their authentication settings?<h3>Employees Need a Way to Verify IT Requests </h3>Security awareness training often tells employees not to click suspicious links or share passwords.That advice still matters, but it does not fully address attacks that arrive through phone calls, account recovery requests, or convincing security instructions.Employees need a clear process for handling unexpected IT communications.That process does not have to be complicated.A few practical safeguards can make a meaningful difference:<ul><li>Use a known support channel. Employees should independently contact IT using an established phone number, portal, or other approved method rather than relying on contact details supplied in an unexpected message.</li><li>Communicate planned security changes. When authentication procedures are changing, employees should know what to expect and where to verify the instructions.</li><li>Control authentication resets. IT support should follow documented identity verification procedures before resetting MFA or enrolling replacement devices.</li><li>Review authentication changes. Unexpected registrations, recovery changes, and unusual sign-in activity should receive appropriate attention.</li><li>Encourage reporting without embarrassment. Employees should feel comfortable questioning a request, even when it appears to come from someone in authority. </li></ul>These measures help employees make better decisions without expecting them to become cybersecurity specialists.They also help legitimate IT teams provide consistent support.<h3>A Practical Way to Verify Who Is Calling</h3>One way businesses can reduce IT support impersonation is to give employees a simple method of verifying whether someone claiming to represent their organization has access to its current verification information.At Nivo 5, we've implemented an organization-wide verification process using a unique security code that changes regularly.When an employee receives an unexpected call from someone claiming to be part of our IT team, the employee can challenge the caller to provide the current code. The employee independently compares that response with the code available through their own authorized security environment.A matching code provides an additional indication that the caller has access to the organization's current verification information. It makes impersonation more difficult without requiring employees to recognize every IT representative by voice or remember individual contact details.This is not a substitute for confirming someone's identity and authority before making sensitive account changes. A shared code could be disclosed or compromised, so MFA resets, account recovery, and permission changes still require appropriate safeguards.The important principle is straightforward: employees should have a practical way to challenge unexpected IT requests rather than being expected to trust the person making them.For business owners, this illustrates how a relatively simple operational control can strengthen the human side of cybersecurity.<h3>The Question Businesses Should Be Asking </h3>There is an important distinction between teaching employees to use security tools and teaching them how to recognize legitimate security instructions.Businesses need both.A company can invest in stronger authentication, require MFA across its applications, and still leave employees uncertain about who is authorized to request changes.That uncertainty deserves attention.A useful starting point is to ask employees and IT support the same question:If someone contacts an employee tomorrow and says their authentication settings must be changed immediately, how would the employee verify that request?If the answer depends entirely on recognizing a familiar voice, trusting a convincing message, or assuming the caller knows what they are doing, the process may need improvement.The goal is not to make employees suspicious of every legitimate IT interaction.It is to give them a dependable way to distinguish authorized support from impersonation.Because sometimes the most important security decision an employee makes is not whether to approve an authentication request.It is whether the person asking them to approve it can be trusted.At Nivo 5, we believe practical cybersecurity should help businesses maintain reliable operations while keeping access to important information under control. If your organization is reviewing how employees receive IT support or how authentication changes are handled, those processes are worth examining before a suspicious request creates a larger problem.

When the Person Helping You Set Up MFA Isn’t Really From IT

For many small business owners, cybersecurity starts with a familiar question: "Do we have antivirus installed on all our computers?"It is a reasonable place to begin.Antivirus software has been an important part of computer protection for decades. It helps identify malicious programs, block suspicious activity, and reduce the likelihood that an infected file will cause damage.But the way businesses use technology has changed.Employees access company information from different locations. Important documents are stored in cloud applications. Email accounts connect to financial information, customer communications, and everyday business decisions. Outside vendors may need access to systems that employees depend on.A business can have antivirus installed on every computer and still face serious security risks.That does not mean antivirus has stopped being useful. It means the business environment has become more complicated than any single protective tool can address.The more useful question is no longer simply whether every computer has antivirus.It is whether the business has considered the different ways its information, systems, and operations could be affected.<h3>Antivirus Protects an Important Part of the Business </h3>Antivirus software is designed to identify and respond to certain types of malicious software and suspicious behavior.Modern endpoint protection can do considerably more than scan files for known viruses. Depending on the product and configuration, it may detect unusual processes, block harmful applications, or provide information that helps investigate suspicious activity.These capabilities remain valuable.A malicious attachment, infected download, or harmful application can interrupt an employee's work and potentially affect other systems.However, not every cybersecurity problem involves malicious software running on a computer.Consider an employee whose email account is accessed by someone who has obtained the correct password.The attacker may be able to sign in through the same application the employee uses every day.There may be no infected file to detect.Or consider a former employee whose access to an important cloud application was never removed. The application itself may be functioning normally, and every company computer may have working antivirus protection.The problem is not necessarily the computer.It is the access that remains available.These examples illustrate why cybersecurity needs to extend beyond individual devices.<h3>Some Security Problems Begin With Legitimate Access </h3>Business owners often think of cyberattacks as attempts to break into a computer or network.Sometimes the problem is that someone gains access through an account the business already trusts.Employee email accounts, financial applications, document storage, remote access systems, and administrative accounts can all become important entry points.If a password is stolen, reused, or disclosed, someone may attempt to access business information without installing malicious software.This is why identity and access management matter.Businesses should be able to answer several practical questions:<ul><li>Who currently has access to important business applications?</li><li>Are employees given only the permissions their responsibilities require?</li><li>Is multifactor authentication enabled where appropriate?</li><li>Are accounts reviewed when employees change positions or leave?</li><li>Can the business identify and remove access that is no longer necessary? </li></ul>Multifactor authentication adds another verification requirement beyond a password. It can make certain account compromises more difficult, although it does not eliminate every form of account-based attack.Access permissions are equally important.An employee who only needs to review invoices may not need permission to change financial settings. A contractor who needs temporary access to a system may not need that access indefinitely.These decisions are not simply technical settings.They reflect how the business operates, who is responsible for information, and how much access each person genuinely needs.For a closer look at managing employee, contractor, and vendor permissions, read our article <a data-mce-href="https://nivo5.com/blog/who-really-has-access-to-your-business-information" href="https://nivo5.com/blog/who-really-has-access-to-your-business-information" title="Who Really Has Access to Your Business Information?" target="_blank" rel="noopener">Who Really Has Access to Your Business Information?</a><figure id="figure-s356n50gpmvigcr79"><img id="s356n50gpmvigcr79" src="https://cdn.durable.co/blocks/ampAINGFT3tAZELKl8V9MlIzYJseC7EURK70m2ncRXKgjCxVdJZfp0kVSejqk6Oy.jpg" alt="Employee using a smartphone to verify a sign-in with multifactor authentication." title="Employee using a smartphone to verify a sign-in with multifactor authentication." class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="Protecting employee accounts requires safeguards beyond traditional antivirus software." data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/ampAINGFT3tAZELKl8V9MlIzYJseC7EURK70m2ncRXKgjCxVdJZfp0kVSejqk6Oy.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"><figcaption class="body-normal text-gray-500 mt-2">Protecting employee accounts requires safeguards beyond traditional antivirus software.</figcaption></figure><h3>Employees Influence Security Every Day </h3>Technology can block many threats, but employees still make decisions that affect business security.Someone receives an unexpected attachment.A manager gets an email requesting an urgent change to payment instructions.An employee shares a document with an outside contact.A staff member receives a multifactor authentication request they did not initiate.None of these situations necessarily begins with a virus.They involve decisions made during ordinary work.The difficulty is that employees are often trying to complete legitimate tasks under time pressure.An urgent payment request may arrive when accounting is preparing a deadline. A suspicious message may resemble a normal customer inquiry. A request to share information may appear to come from someone the employee recognizes.Simply telling employees to be careful is not enough.Businesses need procedures that make the safer decision practical.For example, a request to change banking information can be verified through an established contact method rather than relying on the instructions in the message itself.Employees should know how to report suspicious activity without worrying that asking a question will create unnecessary trouble.Security awareness becomes more useful when it reflects the situations employees actually encounter.The objective is not to turn every employee into a cybersecurity specialist.It is to give people enough guidance and support to recognize when something deserves a second look.Everyday decisions can have a significant impact on business protection. Explore this further in <a data-mce-href="https://nivo5.com/blog/how-everyday-employee-habits-affect-business-security" href="https://nivo5.com/blog/how-everyday-employee-habits-affect-business-security" title="How Everyday Employee Habits Affect Business Security." target="_blank" rel="noopener">How Everyday Employee Habits Affect Business Security.</a><h3>Protecting Computers Is Not the Same as Protecting Business Information </h3>A growing amount of business information exists outside individual computers.Customer records may be stored in a cloud-based application. Financial documents may be accessible through an online accounting platform. Employees may collaborate through shared folders, email, and business communication tools.These services provide flexibility, but they also create responsibilities.Who can share information externally?What happens when an employee accidentally deletes an important document?Can someone access sensitive information from an unmanaged personal device?Does the business know which applications contain its most important information?Antivirus alone cannot answer these questions.Businesses need to understand where important information is stored, how it is accessed, and what controls are available to protect it.That includes reviewing sharing permissions, account security, application settings, and backup or recovery arrangements.It also means recognizing that cloud services and local systems may depend on one another.An employee might use a cloud application, but still depend on the office network, an authentication service, or another connected system to complete their work.Security planning becomes more meaningful when these relationships are understood.Otherwise, a business may protect individual computers while overlooking the systems and information that employees actually depend on.<h3>Cybersecurity Works Better When Protections Support One Another </h3>A more complete cybersecurity approach uses multiple safeguards.This is often called layered security.The principle is straightforward: if one protective measure fails or does not apply to a particular situation, other safeguards may help prevent, detect, limit, or recover from the problem.For a small business, those layers may include:Endpoint protection. Protect computers and other supported devices against malicious software and suspicious activity.Account security. Use strong authentication, appropriate permissions, and regular access reviews.System maintenance. Keep operating systems, applications, and network equipment updated to address known weaknesses.Information protection. Understand where important data resides and control how it is accessed and shared.Monitoring and response. Establish ways to identify suspicious activity and determine who should investigate it.Backup and recovery. Maintain appropriate backups and verify that important information and systems can be restored when necessary.These measures address different problems.A backup does not prevent someone from accessing an account. Multifactor authentication does not replace system updates. Antivirus cannot determine whether an employee should have access to confidential financial records.Each safeguard has a purpose.The goal is not to accumulate as many security products as possible.It is to understand which risks matter to the business and select protections that work together.A complicated collection of poorly configured tools may provide less practical protection than a smaller, well-managed set of safeguards with clear responsibilities.Having multiple security tools is only part of the solution. Learn why coordination matters in W<a data-mce-href="https://nivo5.com/blog/what-happens-when-business-security-tools-don-t-work-together" href="https://nivo5.com/blog/what-happens-when-business-security-tools-don-t-work-together" title="hat Happens When Business Security Tools Don't Work Together" target="_blank" rel="noopener">hat Happens When Business Security Tools Don't Work Together</a>.<figure id="figure-m64ighgv8mvigew82"><img id="m64ighgv8mvigew82" src="https://cdn.durable.co/blocks/9ctVSC3ki1Yibpi1G7BFVxoqCaBgniYJJPshR9zaXnBnvcCRqF9Ei5lDjGNRf6AU.png" alt="Stacked wooden blocks illustrating multiple layers of business cybersecurity protection." title="Stacked wooden blocks illustrating multiple layers of business cybersecurity protection." class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="Effective business security combines endpoint protection, account security, information protection and recovery readiness." data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/><figcaption class="body-normal text-gray-500 mt-2">Effective business security combines endpoint protection, account security, information protection and recovery readiness.</figcaption></figure><h3>Small Businesses Have to Balance Protection With Everyday Operations </h3>Security decisions rarely happen without constraints.Small businesses have budgets, deadlines, employees to support, and customers expecting work to continue.Adding protective measures can also introduce inconvenience.Multifactor authentication may require employees to change familiar sign-in habits. Restricting access may mean someone needs approval before using an application. Installing updates may require coordination to avoid interrupting important work.These concerns are legitimate.Security that repeatedly prevents employees from completing necessary tasks can encourage workarounds.That creates another problem.A better approach considers both protection and usability.For example, instead of giving every employee broad administrative access because it is convenient, a business can establish a practical process for requesting elevated permissions when needed.Instead of allowing unrestricted document sharing, it can define how employees should collaborate with customers and outside partners.Instead of postponing updates indefinitely, it can schedule maintenance around operational requirements.The question becomes how to reduce meaningful risks without unnecessarily complicating the work people need to do.That balance requires an understanding of the business, not just its technology.<h3>How Can a Small Business Decide What to Protect First? </h3>Not every business faces the same risks.A professional services firm handling confidential client documents may have different priorities from a retailer that depends on point-of-sale systems or a manufacturer whose operations rely on connected equipment.The starting point should be the activities the business cannot afford to lose or significantly disrupt.Consider a few practical questions.Which systems are essential to daily operations?Identify the applications, equipment, accounts, and connections employees depend on.If one becomes unavailable, what work stops?Where is the most important business information? Determine where financial records, customer information, operational documents, and other sensitive materials are stored.Who can access them, and how are they protected?What would happen if an important account were compromised? Consider email, financial systems, administrator accounts, and cloud applications.Could someone make unauthorized changes, access confidential information, or interfere with operations?Who is responsible when something suspicious happens? Employees should know where to report concerns.The business should know who can investigate, restrict access, contact relevant providers, and coordinate recovery.Have existing protections actually been checked? A security tool being purchased or installed does not automatically mean it is configured correctly, actively monitored, or covering every intended system.Periodic reviews can reveal missing devices, outdated settings, unnecessary permissions, or responsibilities that nobody clearly owns.These questions help establish priorities without requiring the business to address every possible cybersecurity concern at once.<h3>Progress Should Be Measured by What the Business Can Actually Do </h3>It is easy to measure cybersecurity by counting products.A business may have antivirus, a firewall, backups, multifactor authentication, and several other tools.But the number of tools does not explain how effectively the business is protected.More meaningful indicators come from practical questions.Can the business quickly disable access when an employee leaves?Does someone know when an important protective system stops reporting?Can employees recognize and report suspicious requests?Are important updates being applied?Has the business tested whether critical information can be recovered?Can the people responsible for technology explain what would happen if an important account or system were compromised?These questions focus on capabilities rather than purchases.They also reveal where responsibilities may be unclear.For many small businesses, improving cybersecurity begins with understanding what is already in place, identifying what is missing, and making existing protections more dependable.That can be more valuable than immediately purchasing another product.<h3>A More Useful Question Than Whether Antivirus Is Installed </h3>Antivirus remains an important part of business cybersecurity.But businesses no longer operate entirely within the computers sitting on their desks.Their information moves through cloud applications, employee accounts, connected systems, outside relationships, and everyday business processes.Protecting that environment requires more than detecting malicious software.It requires understanding who has access, where important information resides, how employees work, which systems operations depend on, and what the business can do when something goes wrong.No single tool can eliminate every risk.The objective is to build reasonable, coordinated protections that reflect how the business actually operates.For a business owner, the next useful conversation may not be about buying another security product.It may be about asking a simpler question:If something important went wrong tomorrow, which protections would actually help us recognize the problem, limit the damage, and keep the business moving?That question can reveal considerably more about the state of a business's cybersecurity than knowing whether antivirus is installed.

Why Small Business Cybersecurity Requires More Than Antivirus

Nivo 5

Nivo 5 is a cybersecurity and IT advisory firm based in the Montreal region, helping organizations protect profits, operations, and reputation. We identify hidden security gaps across public-facing footprint, infrastructure, cloud/SaaS, and user risks. Our approach starts with a risk-based assessment built on real-world exposure—not assumptions—then aligns cybersecurity with operational priorities.

Blog

When the Cloud Goes Down, Who Keeps Your Business Running?

When a Familiar Voice or Message Is No Longer Proof of Id...

When Your Cloud Provider Becomes the Business Disruption

When a Security Warning Leaves Businesses With a Difficul...

When the Person Helping You Set Up MFA Isn’t Really From IT

Why Small Business Cybersecurity Requires More Than Antiv...