Welcome to The Senroc Download! This is your weekly briefing from the team at Senroc Technologies letting you know what we're seeing, what we're thinking, and tips you can use right now.

Anthropic has started embedding invisible markers into text produced by its Claude assistant, to comply with new European transparency rules requiring AI-generated content to be identifiable. Other AI providers are expected to follow, because the regulation applies to them too.

The reaction online was revealing. A vocal group of users were upset — not about privacy, but because they had been submitting AI-written work as their own at their jobs and at school, and invisible watermarking makes that detectable. Most other commenters thought that was rather the point.

For a business owner, the interesting question isn't whether watermarking is good or bad. It's whether your team currently knows what's acceptable. In most small companies, AI use grew organically without anyone writing anything down, which means nobody is quite sure whether an AI-drafted client proposal is resourceful or a problem.

Takeaway: You don't need a formal policy document, but you do need a shared understanding. Three questions are enough to get started: is it fine to use AI to draft client-facing work, does it need to be disclosed, and what company or client information must never be pasted into an AI tool? Answer those out loud with your team and you've eliminated most of the risk. The last one matters most — anything confidential going into a consumer AI tool is an exposure that's genuinely hard to undo.

RingCentral, the business phone and messaging provider used by a very large number of small and mid-sized companies, was breached over the summer. Personal information tied to 1.6 million accounts was stolen, and the criminals behind it published the data after the company did not pay their extortion demand.

Nothing customers did wrong caused this. That is precisely why it's worth discussing. You can have solid passwords, multi-factor authentication turned on, and current patches everywhere, and still have your company and staff details exposed because a vendor you rely on had a bad month.

The part worth planning around is how you would find out. Whether a vendor tells you, and how quickly, comes down to what its contract commits to and what the law requires of it — neither of which you control, and both of which you would be reading for the first time in the worst possible week to be reading anything. The more useful question is the one that is entirely yours: how fast would you notice on your own?

Takeaway: Set up breach monitoring on your own domain, so that finding out about a breach does not depend on a vendor’s goodwill. Have I Been Pwned will watch a domain you own and email you whenever an address at your company appears in a published breach. Setup is simple. You verify ownership once, and it is free for domains with up to ten breached addresses, a few dollars a month beyond that. Second thing to check is the notification email for all your major vendor accounts. If a vendor does send a breach notice, you don’t necessarily want the email going to a billing address or an email for someone who has left the organization.

Windows Server 2022 reaches the end of what Microsoft calls mainstream support on October 14. It won't stop working, and critical security patches continue for several more years, but it stops receiving the general fixes and improvements that keep a server healthy over time.

The more pressing one is Exchange Server 2016 and 2019. Microsoft's extended security update program for those versions ends in October, and after that there are no more security patches at all. An email server that no longer receives security fixes but is still reachable from the internet is one of the more dangerous things a business can operate.

Both deadlines only apply if you run these on your own hardware. Businesses using Microsoft 365 for email are not affected by the Exchange deadline — though it's worth confirming rather than assuming, because plenty of companies migrated years ago and left an old server running quietly in a closet.

Takeaway: You need two answers this month: do we run our own email server, and do we run Windows Server 2022? If the answer to the first is yes, a migration plan needs to exist now — moving email is not a weekend job, and October is closer than it looks. Also worth asking whether any old server is still powered on and connected but no longer actually used. Those are common, and they're a genuine liability.