ITGuys Team

09/18/2026

A Colorado town lost over $1 million a few years back because of one skipped phone call.

Someone filled out a form on the town's own website asking to change how a contractor got paid. Nothing about it looked unusual. Staff checked some of the details, but nobody picked up the phone to confirm it with the actual contractor. By the time the bank flagged it as fraud, the money was already gone.

No hacking. No malware. Just a normal-looking request that nobody verified.

That's still how most of these scams work, and it's a big part of why Colorado businesses lost over $355 million to internet crime last year. We pulled the FBI's latest Colorado numbers and broke down what small businesses here can actually do about it:

Colorado ranks 7th nationally per capita for cybercrime. See what the FBI's latest data means for local small businesses, plus the state's breach notification rules.

09/09/2026

Most business email compromise cases don't involve a hack. No malware, no breached network, no stolen password. Someone just forges the "From" field on an email and asks for something normal: an updated invoice, a routine banking change, a wire before end of day.

Email was built in the early 1980s with no way to verify who actually sent a message. That gap is still open at a lot of companies, and attackers know it. In 2025 alone, the FBI logged nearly $3.1 billion in reported BEC losses, most of it moved by wire before anyone caught it.

The fix isn't one thing. It's DNS-level authentication (SPF, DKIM, DMARC) closing the technical gap, paired with a simple habit: verify any payment change through a second channel before you act on it. Neither one alone is enough.

We wrote up how this plays out in practice, including a case where a spoofed vendor email cost a city government $6 million: https://mynewitguys.com/email-spoofing-business-email-compromise-guide/

09/03/2026

Try this experiment: open ChatGPT or Perplexity and ask it to recommend a business like yours. See if you actually get named.

For a lot of small businesses, the answer is no, even ones that rank well on Google. A recent benchmark study of 200+ U.S. service businesses found the average company scores just 30 out of 100 on AI visibility. Ranking on page one of Google only translates to a ChatGPT mention about 6 times out of 10.

Here's the part worth knowing before you spend a weekend "fixing" it: a rigorous 2026 study from Ahrefs tracked nearly 1,900 pages that added schema markup, the technical fix most commonly pitched as the AI citation shortcut, and found it produced no meaningful increase in AI citations on any platform. Google's own documentation backs this up, stating plainly that no special markup is required to appear in AI Overviews.

What actually seems to move the needle is less technical and more fundamental: stating your answer plainly and specifically near the top of the page, staying consistent across every listing of your business, and earning genuine third-party mentions instead of just describing yourself well on your own site.

We broke down what the current research actually shows, including a quick self-check to see where your own business stands. Further reading: https://mynewitguys.com/ai-search-visibility-small-business-guide/

08/26/2026

Quick gut check for business owners: could you list every piece of software your company currently pays for, right now, off the top of your head?

Most owners can't get past the tools they personally use. Marketing has its own subscriptions. Sales has its own. Ops has its own. Someone signed up for a free trial eight months ago that became load-bearing infrastructure and nobody ever told finance.

None of that happens because anyone is careless. It happens because buying software got so easy that it stopped feeling like a decision. A credit card and an email address is all it takes now, and that convenience is exactly what makes it invisible.

The part that actually costs businesses money and exposure isn't the sprawl itself, it's what the sprawl hides. Duplicate tools nobody remembers to cancel. Access nobody remembers to revoke when someone leaves. Vendor relationships nobody in the building could describe if asked.

The fix isn't a lockdown. It's a habit: know what you're running, know who owns each tool, and build offboarding around a real list instead of a memory exercise. That one habit closes more risk than most security spending does.

We put together a deeper look at where this goes wrong and how to get ahead of it: https://mynewitguys.com/blog/saas-sprawl-small-business-risks

08/17/2026

Most offboarding checklists cover the visible stuff: collect the laptop, disable the email account, done.

But access doesn't live in one place anymore. It's spread across a dozen SaaS logins, shared credentials, forwarding rules, and sessions that never got logged out. Unless someone kept a running inventory of every account a person was ever given, IT is stuck trying to reconstruct it from memory when that person leaves.

That's usually the actual failure point, not carelessness, just structure. Access gets granted incrementally over months or years. It should get revoked the same way, deliberately and all at once, not reassembled after the fact.

The fix isn't complicated: log access as it's granted, cut it off at the identity layer first (this is where single sign-on earns its keep), and do a short follow-up review a few weeks after someone leaves to catch what slipped through.

https://mynewitguys.com/employee-offboarding-security-checklist-small-business/

08/06/2026

A federal court voided a company's entire cyber insurance policy over one missing checkbox.

Not fraud. Not a lie. Someone answered "yes, we have MFA" without knowing it was only enabled on the firewall, not the servers, not remote access, not the system ransomware actually got through.

The insurer sued. The court sided with them. The policy was voided from day one, right when the business needed it most.

This is happening more as insurers dig deeper before paying claims. In our latest article, we break down:
→ The 6 controls insurers actually check (MFA, EDR, tested backups, IR plans, patching, training)
→ Why "we have MFA" and "we have MFA everywhere" are two different claims
→ What to verify before your next renewal

Read it here: https://mynewitguys.com/what-your-cyber-insurance-policy-actually-requires-and-why-so-many-claims-get-denied/

07/31/2026

Quick story from our week: someone tried to get us to wire $12,000 to a fake vendor using a two-part scam. First a normal-looking invoice, then a follow-up email made to look like it came from our own owner, telling us to pay it fast and skip the usual checks.

It didn't work, but it was close enough to good that we wanted to share it. If a payment request ever tells you to skip your normal process, that's not a reason to move faster. That's the reason to stop and make a phone call first.

We wrote up exactly how the scam was built and what to watch for. Check it out if you want your team ready for the next one.

https://mynewitguys.com/someone-tried-to-scam-us-out-of-12000-heres-exactly-how-it-worked/

07/22/2026

Quick gut check: if your systems went down tomorrow, would you actually know what to do?

A lot of businesses have backups running in the background and just assume that means they're covered. But we've seen plenty of cases where the backup itself was fine and the business still lost a couple of days, just because nobody had a plan for actually using it. No one had tested a restore. No one knew what order things needed to come back in.

Backups protect your files. Getting back up and running takes an actual plan.
https://mynewitguys.com/backup-vs-disaster-recovery-small-business/

07/16/2026

Ever scanned a QR code on a flyer, an invoice, or a "delivery notice" text without thinking twice? So has almost everyone else, and that's exactly why scammers have shifted to hiding phishing links inside QR codes instead of typed links.

It's called "quishing," and it's one of the fastest-growing scam tactics of 2026. We put together a plain-English guide on how it works and how to protect your business (and yourself).

Check it out: [https://mynewitguys.com/qr-code-phishing-quishing-the-scam-hiding-in-plain-sight/]

07/09/2026

Still Running Windows 10 in 2026? Here's What You're Actually Risking.

Windows 10 reached end of support in October 2025, but many businesses are still relying on it every day.

The problem isn't that it stops working. The problem is that it stops being protected.

In our latest article, we explain:

• What end of support really means
• Why unsupported PCs become attractive targets for attackers
• The real cost of Microsoft's Extended Security Updates (ESU)
• How Secure Boot certificate expirations create another layer of risk
• Practical steps every business should take to protect their network

If your organization hasn't completed its Windows 11 migration, now is the time to understand what's at stake.

Read the full article: https://mynewitguys.com/still-running-windows-10-in-2026-heres-what-youre-actually-risking/