Welcome to The Senroc Download! This is your weekly briefing from the team at Senroc Technologies letting you know what we're seeing, what we're thinking, and tips you can use right now.

Here's a genuinely strange statistic. The underlying cost of AI processing has fallen roughly 98 percent since early 2024. Over the same period, 73 percent of companies still blew past their AI budgets. Cheaper didn't translate to less expensive.

The explanation is that when something gets cheap, people use much more of it. AI tools now work more autonomously handling entire tasks rather than just answering a single question. This consumes enormous amounts of processing behind the scenes. Analysts found that in these tools, only 5 to 15 percent of the work produces the answer you actually see. The rest is the tool reading context, reasoning, and checking itself.

One practical detail stands out for smaller businesses: messy source material costs real money. Feeding an AI tool a scanned PDF or a badly structured document takes far more processing than clean, well-organized text, and you pay for that difference.

Takeaway: If your business pays for AI tools per usage rather than a flat monthly fee, set a spending alert now rather than finding out at the end of the quarter. Flat-rate plans are usually the safer choice for a small business precisely because the bill is predictable. And if you're feeding documents into an AI tool routinely, cleaning up the source format is one of the few easy ways to cut cost without cutting capability.

The US Cybersecurity and Infrastructure Security Agency has confirmed that attackers are actively exploiting a serious weakness in Microsoft SharePoint. The fix has been available since July, but criminals are having real success against organizations that haven't applied it yet — and this is not the first SharePoint weakness to be exploited this way in 2026.

One important distinction: this affects SharePoint running on a server inside your own building or data center. If your files live in SharePoint as part of Microsoft 365 in the cloud, Microsoft patched that for you and there's nothing for you to do. Many businesses genuinely don't know which of the two they have.

The pattern is worth noticing. Once a fix becomes public, attackers study it to work out what weakness it closed, then hunt for anyone who hasn't installed it. The gap between a patch being released and it being attacked is now measured in days.

Takeaway: Find out today whether you run SharePoint on your own server or use it through Microsoft 365. If it's your own server and the July and August updates aren't installed, treat that as urgent — this is an active exploitation, not a theoretical risk. If you're not sure which you have, ask your IT provider where you stand before the weekend.

Researchers found 737 free VPN and privacy extensions for Chrome that did the opposite of what they advertised, routing users' entire browsing through servers controlled by the extension makers. About 275 of these VPNs impersonated genuinely trusted brands — Proton VPN, NordVPN, Surfshark, ExpressVPN and others — by copying names and logos closely enough to pass at a quick glance.

Browser extensions are an easy blind spot. They install in two clicks, they don't show up in most security scans, and they get around needing an administrator to get it installed. Unfortunately, an extension with permission to read everything on the pages you visit can see your webmail, your banking, and your business systems.

Takeaway: Audit the extensions on your work and personal computers this week. Type chrome://extensions in Chrome or edge://extensions in Edge to see the full list. Remove anything you don't recognize or don't actively use, and be especially skeptical of anything free that promises privacy or a VPN — running that service costs money, so if you're not paying, it's worth asking how they are. Quarterly is a reasonable cadence for re-checking.