On a leaver's last day, Operations should not have to choose between leaving company data in place and wiping somebody's personal phone. Microsoft documents a more selective route for supported, Intune-managed apps on iOS/iPadOS, Android and Windows. Company data can be removed from those apps while the person's own data stays on the phone. But the route has to be prepared. On Android and iOS, the apps need Application Protection Policies in place. The request is not instant proof that the job is done. The person must open the app, and Microsoft says removal may take up to 30 minutes after the request. The report can still show pending or failed. There is also a boundary. In Outlook, contacts copied from the app into the phone's address book are removed. If those contacts were then copied to another outside source, Microsoft says they cannot be wiped through this route. Before the next leaver event, ask your authorised IT owner which personal devices and work apps are covered, how completion is checked and what copied data sits outside the control. Storm-IT can review the Intune setup and build the agreed check into starter and leaver provisioning.

When a supplier project ends, Operations closes the purchase order and archives the files. The remote-access service set up for the work needs its own decision. A joint cyber-security advisory co-authored by the UK National Cyber Security Centre and partners says the observed actors combined automated scanning with hands-on exploitation. Its first key action is to disable unused services and ports, including unneeded routes for automatic configuration, remote access or file sharing. This does not mean every remote-access or file-sharing service should be switched off. A service the business still needs should be authorised, maintained and protected alongside controls such as timely patching and multifactor authentication. But a service with no current business purpose should not stay available just because it can be monitored. Put one question into the next IT provider review: which internet-facing services still support the business, and which unnecessary routes can be disabled through an authorised change? Storm-IT offers annual external and internal cyber-audit projects that can support that review. Staff should not scan or change live systems themselves. #CyberSecurity #BusinessContinuity

Operations has a recovery time written into the continuity plan. The technical team is confident it can meet it. Finance still needs one answer: what work must be possible by then? Veeam’s Data Trust and Resilience Report 2026 drew on input from 900+ security leaders. It found that 90% were very to extremely confident they could recover within defined recovery time objectives. Only 69% said those objectives were fully aligned with their organisation’s business continuity goals. Those figures answer different questions. One asks whether the technical time target can be met. The other asks whether it is the right target for the business. Put one current target in front of the business owner and the technical owner. Agree which business activity must be possible at that point, then record who approved the fit. Storm-IT can bring that conversation into a quarterly business review and relate it to the current continuity setup, including Datto BCDR/Siris or Storm Cloud where those services are in scope. That is not a recovery guarantee. It is a practical way to make the business requirement explicit.

An unexpected AI workspace invitation lands with an Operations Director. It comes from the real platform and offers Owner access, so it looks like the sort of admin request that can be accepted and sorted out later. BleepingComputer reported a campaign found by Push Security where that trust was misplaced. The invitations came from OpenAI’s genuine notification address, passed email authentication checks and led to organisations created by an attacker. Invitees were given Owner privileges, and a Visa card was already attached to the billing account. Those details made the workspace look established. They did not prove that the employer created or controlled it. The report found that none of the targeted employees had joined. The suspected aim was to collect information put into the workspace, but that was not confirmed, and the report did not confirm any data theft. Treat an unexpected organisation or Owner invitation as a request to verify, not a badge of legitimacy. Before anyone accepts, check it through a separate company route you already trust. Then ask an authorised owner to review which SaaS organisations staff currently belong to. #CyberSecurity #Operations

The quote is ready for approval. Someone has added Microsoft’s new 7.5% promotion to the budget notes. Before Finance signs it off, the quote needs to answer two questions. Microsoft says the promotion began on 1 October 2026 for eligible CSP direct-bill partners and distributors offering Defender Suite for Business Premium or Purview Suite for Business Premium. The customer must also be eligible and have fewer than 300 seats. Microsoft then gives the partner discretion over how to reflect the promotional pricing in its offer. In other words, the public percentage and the customer price are connected, but one does not automatically prove the other. Ask whether this exact quote qualifies. If it does, ask the supplier to show how the promotion appears in the quoted price and what the ongoing price will be outside the promotion. That is a calmer approval conversation than treating the headline percentage as a guaranteed saving. It keeps the public announcement, the supplier’s offer and the number Finance is approving in the right places. #Microsoft365 #Finance

Your web agency says the client portal update is ready. Before it goes live, there is another useful question: what else can its build platform reach? Microsoft published one incident on 29 September 2026 in which a malicious deployment pipeline was authorised to access more than 50 resources and authenticated services. A deployment pipeline is the automated route that takes software changes into a live system. Investigators also found seven stolen Kubernetes configuration files added to a repository. Those files can hold connection and authentication details for cloud systems. This was one incident at one organisation, not evidence that every supplier or build platform has the same reach. The wider access came from trusted pipeline permissions and service connections. Source code access alone does not automatically provide production access. At the next supplier review, ask for a plain English explanation of which live systems the development platform can authenticate to, who may create or change the route, and what independent approval is required before a critical change runs. Keep that explanation with the supplier record so the business decision is clear before the next release. #CyberSecurity

The branch inbox shows a fresh Zoopla valuation enquiry. Before anyone assumes the follow-up has started, look for the matching lead in the CRM. Zoopla Member Support documented a Prospect Plus scenario in which the receiving system rejected a new portal-source value. In that situation, the lead did not enter the CRM and Zoopla said this would likely create a CRM error. The separate email notification still arrived. The email proves that a notification exists. It does not prove the CRM has created the lead, assigned it to somebody or started the usual follow-up. Take one recent, authorised Prospect Plus notification and compare it with the CRM. Find the matching record, its owner and the follow-up status. Keep names, contact details and property information out of any public discussion. Then ask the responsible supplier or systems owner to show how rejected entries are reported and how portal change notices are handled. The useful proof is the lead sitting in the working queue with a clear next action, not the email sitting in the inbox. #EstateAgency #Operations

The ransomware stories that reach the boardroom usually involve household names. That can make a smaller office feel safely outside the picture. Kaseya's release for its 2026 INKY Email Security Report says 82% of ransomware attacks target organisations with fewer than 1,000 employees. That is a broad size band. It is not a UK small-business attack rate, and it does not tell a 10-to-50-user firm its own odds. What it does remove is headcount as a sensible reason to leave staff practice untested. The same release says AI-generated phishing has become the baseline, with attackers able to produce convincing messages at scale. It does not say every ransomware incident starts with email. It does make a familiar-looking message a poor place to rely on instinct alone. Run one harmless phishing drill. Use a message that could reasonably reach the office, then see whether people use the real reporting route. If they hesitate, improve the route and explain it again. Do not turn the result into a list of people to blame. The useful result is simple: staff know how to stop and report a convincing message before a real one arrives. #CyberSecurity #Operations

Your software supplier sends a project for your developer to inspect. Nobody has pressed Build or Run, so it can feel as though nothing is active yet. Unit 42 documented one targeted campaign in research published on 6 October 2026. In that case, a malicious Visual Studio project used its `.csproj` file, which tells the development tool how to load and build the project, to run instructions as the project opened. Visual Studio was doing its normal background loading work. The malicious program launched while the developer was still reading the `Readme.md` file. This does not mean every outside project or coding assessment is unsafe. It does mean that waiting until Build or Run to decide whether an unfamiliar project is trusted can be one step too late. Before a project reaches a normal work laptop, have the authorised technical owner verify the sender and repository through a known route, then arrange an isolated test environment. The useful business instruction is not “open it carefully”. It is “do not open it until the route and test environment have been agreed”. If recruitment, customer or supplier work can bring outside code into the business, add that handoff before the next project arrives. #CyberSecurity

The Business Central upgrade is booked. Operations has one more date to ask for: when was the `28+` licence key downloaded? Microsoft changed the licence-key model on 1 October 2026 for on-premises Business Central versions 28 and later. Instead of a new key label for every release, those versions now use `28+`. Releases before version 28 keep their version-specific keys. The new label looks as though it should cover every later version. Microsoft says the download date still decides which version the key covers. Its own example says a `28+` key downloaded on 1 October 2026 would produce a version-compatibility warning if used with version 30 in April 2027. A newly downloaded `28+` key would cover version 30. Nobody in Finance or Operations needs to touch the licence file. Before the upgrade starts, ask the Business Central supplier to confirm that the key was refreshed after the target version became available and was included in the tested plan. Keep that confirmation with the upgrade approval. It answers the question the `28+` label cannot.

The broadband renewal is in front of Finance. The quote says 99.9% availability. Operations has a different question: what happens to client calls and urgent work when the main connection is unavailable? Ofcom says a 99.9% service availability figure can mean services are down for ten minutes per week on average. That does not set a weekly limit or promise a repair time. It shows average availability over time. Resilience is a separate question. So is how the working day continues. Can calls still reach the right person? Can the team continue the work that cannot wait? Do the phone service and online systems rely on the same connection? Before signing or renewing, ask the supplier or IT partner to write down three things in plain English: what the percentage measures, what resilience is included, and which important parts of the working day rely on the same connection. Put those answers beside the price and the headline percentage. They show Finance and Operations more clearly what the business is actually buying.

When IT support needs system access, what can your business explain afterwards? The answer is not meant to be “nobody ever went in”. Legitimate support and maintenance often require access. The useful answer is who used it, when they did so and why the work required it. That wording comes from Department of Health and Social Care guidance published on 29 September 2026 for adult social care providers in England. It says an MSP should be able to tell the organisation who accessed its systems, when and why. This is sector-specific guidance, not a universal rule for every small firm. We think the question travels well because an owner or Operations lead should not need to interpret raw security logs to understand access by a trusted supplier. Put one item on the next provider review agenda: show us the access record in a form we can understand. Ask whether it connects an accountable person or support identity to the time and business reason, then establish who reviews it. The aim is not to interrupt legitimate support. It is to make necessary access explainable afterwards.

Two people in the same office open Microsoft 365 Copilot. One sees a new model choice. The other does not. Microsoft announced GPT-6.1 Sol and Claude Sonnet 5.5 for eligible Copilot experiences on 30 September. Rollout is gradual, and Microsoft says the choices depend on the Copilot experience, the user’s licence and which AI providers the organisation has enabled. Provider access can also be limited to particular users or groups. That means a public launch post is not a staff access list. If a manager tells everyone to “use the new model”, some people may not be able to find it, while others may have access the business has not yet covered in its guidance. There is no need to change a setting or buy anything today. Ask the authorised Microsoft 365 or Copilot owner for three things: the models people can currently select, the groups that are eligible and the providers the business has enabled. Then update the short staff guide to match what people can actually use. Start with the company’s real access, not the launch headline. #Microsoft365Copilot

By 10am, the person looking after cyber security is already sorting a new starter, a supplier query and a slow laptop. The routine security queue is still waiting. On 17 September 2026, ESET published a vendor-commissioned UK study carried out by Go4Insight. It covered 500 cyber security decision-makers at firms with 25 to 1,000 endpoints in Q1 2026. ESET found that 86% of surveyed firms did not outsource any part of cyber security through managed detection and response or managed security services. That finding does not prove every business should outsource, or that internal teams are ineffective. It points to a quieter management question. When cyber security sits inside a wider job, has the routine review work been given a protected place? The person needs time to review alerts and clear authority to escalate anything material. An internal deputy also needs to keep the routine check moving when the usual person is busy or away. At your next management meeting, open the diary. Ring-fence a regular review slot, agree what can be escalated without delay, and name the internal deputy for ordinary cover. Responsibility only works when the routine work has room to happen.

A colleague opens a replacement laptop and expects “Windows backup” to put their working day back where it was. Microsoft changed one part of that picture on 30 September. On eligible Windows 11 version 26H2 devices, settings backup is now on by default when an administrator has not already made an explicit choice. Existing choices to enable or disable it still stand. The name sounds broader than the feature. Microsoft says it preserves Windows settings and a list of Microsoft Store apps. It does not back up the user’s files, and it does not switch on the separate restore route. That means a green backup setting can be useful without answering the business question: what will actually return when a laptop is reset or replaced? Ask whoever manages your Windows devices to show the whole route in plain English. Which settings come back? Where do the files come from? Is restore enabled for the devices you intend to use? How will the replacement setup be checked? The aim is not to change a live policy today. It is to know which parts of recovery are covered before somebody is waiting for a new laptop to work. #BusinessContinuity #Windows11

The sign-in worked because the account was real. That does not make the activity safe. An Operations lead sees an unexpected sign-in under a colleague's name. The first response may be to reset that password and contain the account. That matters, but it may not answer whether the intruder used the access to steal other credentials or try other accounts. Microsoft's 2026 Digital Defense Report, published on 1 October, says valid accounts accounted for 20% of observed initial-access techniques in Microsoft Defender Experts customer notifications. In this category, the activity used legitimate credentials such as stolen passwords, successful password sprays, replayed session tokens or hijacked accounts. Of those valid-account intrusions, 52.2% involved follow-on credential theft. The figures do not mean every unexpected sign-in spread further. They do show why stopping at the first account can leave the most important question unanswered. When one real account is used unexpectedly, does your response stop after containing it, or also check whether more credentials were taken and access spread? #CyberSecurity

At the next application review, someone opens last year's agenda and asks for the new Microsoft release-wave pack. That familiar agenda item now needs rewriting. Microsoft says Dynamics 365, Power Platform and Dataverse roadmap content is moving to the AI at Work roadmap. It is replacing twice-yearly release waves with continuous roadmap and change communications. There is no September 2026 Release Wave 2 announcement, and Release Planner retires on 15 November 2026. The important distinction is easy to miss. Microsoft says product release schedules, deployment processes, Message Center notifications and product documentation remain unchanged. The planning information is arriving differently. The release process has not changed. That matters if the old pack was your cue to decide what deserved attention. Ask the authorised application owner or provider to show you the replacement source, explain how they filter for business-relevant changes, and set out when those changes will reach the normal Operations review. Do not add another alert for staff. Replace one stale agenda item with a review habit that still works. #Microsoft #Operations

Your colleague opens ChatGPT for help. A polished assistant says the service is having trouble, offers a backup route and explains what to do next. Before they follow it, check who built the assistant. The website and the assistant’s builder are not necessarily the same party. A Custom GPT is an assistant made by a third party or community builder and hosted on ChatGPT. Huntress reported on 28 September that attackers had created two Custom GPTs for one campaign. The assistants appeared on the genuine ChatGPT site, claimed the main service had limited availability and sent people to a supposed backup site. A fake verification step then asked them to run a command. That does not make every Custom GPT or outside link unsafe. It does mean the familiar platform address only tells you where the chat is hosted. It does not make the builder’s status message, link or instruction official. Give staff one clear rule: check unexpected service or account instructions through the provider’s documented status or support route, or through the IT contact your business already uses. If an assistant asks them to leave the service and run a command or installer, report it rather than follow it. #CyberSecurity #AI

One of your staff's work emails appears in a breach database. Take it seriously, but don't announce a company breach. Have I Been Pwned added its June 2026 Stealer Logs collection on 15 June 2026. The entry records 56.3 million affected addresses and 124 million unique passwords. A result like that can come from another service used with the address, or from login details captured somewhere else. On its own, it does not prove the employer was directly hacked. It still matters because a password reused on another account can carry the exposure with it. Start with what you can verify: the affected address and the source named in the result. Change the affected password on every account where it was used, then enable two-factor authentication wherever it is supported. Make sure someone in the business receives and owns future alerts for the domain. In the management meeting, move past "Have we been hacked?" Ask which account is affected, where the password was reused and who is dealing with it. #CyberSecurity

Finance sees a ransom demand moving down. Operations still has to answer what happens when the client system will not open. Sophos's 2026 report surveyed 2,158 IT and cyber security decision makers at ransomware-hit organisations with 100 to 5,000 employees across 17 countries. In that respondent set, attacks encrypted data in 56% of cases, up from 50% in the 2025 report. The report's separate demand analysis covered 1,214 organisations whose data was encrypted and excluded demands of $40 million or more. Its median demand was $698,000, down 65% over two years. Those figures describe two different business problems. The demand is what the attacker asks for. The disruption is email, client records, shared files or a critical application being unavailable while people are waiting for an answer. Bring one question to your next continuity review: if ransomware encrypted live data, which critical client service would be restored first? Ask how long the latest tested recovery took and whether the restored service was actually usable. A smaller demand is not a recovery plan. #CyberSecurity #BusinessContinuity