Welcome to The Senroc Download! This is your weekly briefing from the team at Senroc Technologies letting you know what we're seeing, what we're thinking, and tips you can use right now.

Microsoft's August update fixed more than 400 separate security problems. That number would have been remarkable a couple of years ago; it is now roughly normal, and the reason is that both security researchers and criminals are using AI to hunt for weaknesses far faster than either could manually.

The consequence of this is attackers now study a newly released fix, work out what weakness it was closing, and start hunting for organizations that haven't installed it yet. They are often able to find a list of these organizations within days. India's national cyber agency recently went as far as recommending that internet-facing systems be patched within 12 hours where feasible, specifically citing AI-assisted attacks.

Twelve hours isn't realistic for most small businesses due to business continuity. However, the mindset of "we do updates when we get around to it" is no longer a defensible position when attackers are no longer taking months to identify targets.

Takeaway: Ask your IT provider two specific questions: how quickly do our systems get security updates after release, and which of our systems are reachable from the internet? The second list — firewalls, remote desktops, application servers, websites you host yourself — is where speed genuinely matters. Everything else can follow a normal monthly rhythm. If nobody can answer the first question with a number, that is the gap worth closing.

A criminal operation called CRPx0 spent this summer advertising something that should change how small businesses think about their odds. For a $333 joining fee, anyone can sign up as an affiliate, keep 70 percent of whatever they extort, and let the operators supply the malware, the infrastructure, and even the victim negotiation panel. The pitch, in their own words, is that it’s built to be operated by someone with no technical background. Researchers tracking their leak site counted fewer than ten claimed victims in June. By late August it was 48.

The break-in method is the part worth understanding, because it doesn’t involve a patchable vulnerability. Victims land on a page showing a fake Windows update screen or a fake “prove you’re human” verification box, and are told to copy a line of text and paste it into a command window to continue. The attackers are exploiting employees following what looks like a routine instruction to patch their computer.

The old comfort for a small business was that skilled attackers were going after bigger targets. That mindset was always thin, but off-the-shelf kits like this one remove this notion entirely. The person running the attack no longer needs skill, so they no longer need a target worth the effort. They will take whatever presents itself because the barrier to entry is so low.

Takeaway: Remember one thing and share it with your entire team: no legitimate website and no genuine Windows update will ever ask you to copy something and paste it into a command window. If a page asks, it’s an attack — close the tab and tell your IT provider.

Microsoft 365 broke on Monday. Exchange Online, the service behind business email, started delaying and failing messages, and Microsoft acknowledged the problem late Monday morning. It didn’t report mailbox connectivity restored until early Tuesday — the better part of a day with email either slow or simply not working. Microsoft traced it to a problem with a core authentication component shared by several of its internal services.

Email issues was likely why you knew there was an outage. However, the last detail explains why this wasn’t just an email outage. The broken piece was authentication — the system that decides whether you’re allowed in — so it didn’t stay confined to Exchange. Teams, SharePoint, OneDrive, and even Microsoft’s own security tooling were caught up in it. Single sign-on is genuinely good for security. It also means one broken component can take everything at once.

Nothing about this was an attack, and no customer could have done anything differently. Moving to the cloud is the right move for most small businesses because it gives you better security and patching than you could manage on your own — but it doesn’t necessarily handle business continuity. When it’s down, you wait. What your team does while waiting is the only part you actually control.

Takeaway: You should be identifying three things in the wake of this outage. Where does the team go when email is down? A group text, a phone tree, anything that doesn’t depend on a Microsoft sign-in. Who checks the status page and tells everyone what’s happening? And what should people not do? This last point matters most because an outage is going to be when staff goes to great lengths to continue working. This could mean forwarding work to personal email accounts or sending client files over text message. These types of actions could have lasting effects well beyond the outage.