Microsoft just made a call that will land in every Microsoft 365 tenant sooner rather than later: passkeys are becoming the default authentication method in Microsoft Entra ID, and SMS and voice codes are being retired as native Entra capabilities in early 2027. If your business uses Microsoft 365 — and most do — this affects you.

Here’s the short version of the timeline Microsoft published:

• September 1, 2026 — Microsoft begins rolling passkeys out as the default MFA experience in Entra ID. Users currently on SMS or voice will automatically be enabled for passkeys and prompted to register one the next time they sign in.
• February 1, 2027 — Microsoft-provided SMS and voice authentication is retired. Organizations that still need text-message or phone-call codes will have to contract with a third-party telecom provider through the Microsoft Security Store, and pay separately for it.

“Passwords with a text-message code stopped being ‘good enough’ the moment AI-driven phishing kits started harvesting one-time codes in real time. Passkeys are the first MFA method built for the threat landscape we’re actually in.”

— Glenn Kupsch, President, Adaptive IT

Why Microsoft is doing this

SMS and voice codes were a huge step up from passwords alone, but they were never truly phishing-resistant. Attackers intercept text messages, socially engineer help desks into SIM-swapping numbers, and increasingly use AI-driven phishing kits that harvest one-time codes in real time. Microsoft Threat Intelligence says AI-assisted phishing campaigns are now hitting click-through rates as high as 54%, compared to about 12% for traditional phishing.

Passkeys sidestep the whole problem. They use public-key cryptography tied to a specific device, so there’s no shared secret to steal, no code to intercept, and no phone number for an attacker to hijack. They’re also faster for users — a face scan or fingerprint instead of waiting for a text and typing six digits.

What this means for your business

If your team signs in to Microsoft 365 with a text-message code today, that experience is going to change — and if you do nothing, it’ll change for you starting in September. A few things worth thinking about now:

1. Inventory who’s still on SMS or voice. Anyone still using text-message MFA is on borrowed time and, more importantly, sitting on the weakest link in your security posture.
2. Decide which passkey type fits your users. Entra supports synced passkeys (iCloud Keychain, Google Password Manager, etc.) that follow a user across their devices, as well as device-bound options like Microsoft Authenticator passkeys, Windows Hello, and FIDO2 security keys. Different roles may warrant different choices.
3. Plan the rollout before Microsoft plans it for you. Automatic enrollment is convenient, but “surprise, you have a new sign-in method” is a support-ticket generator. A short user communication and a scheduled registration window prevents most of that noise.
4. Update recovery paths. If SMS was your fallback for account recovery, that fallback is going away. Every user needs at least two working phishing-resistant methods.
5. Budget for the exception cases. Shared mailboxes, service accounts, kiosk logins, and users without smartphones all need a plan. If you truly need SMS/voice after February 2027, you’ll be paying a third-party telecom for it.

The bigger picture

This is the direction the entire industry is moving. Google, Apple, and the FIDO Alliance have been pushing passkeys for years, and Microsoft flipping the default in Entra ID is the loudest signal yet that the password-plus-text-code era is ending. For most small and mid-sized businesses, the right move is to get ahead of the September rollout, not react to it after the first help-desk call.

Need help planning your passkey rollout?

If your business runs on Microsoft 365 and you’d rather not figure this out during the first Monday-morning support wave, Adaptive IT can plan and execute the passkey transition for you: audit your current MFA methods, pick the right passkey types for each group of users, set up a registration campaign, write the user comms, and clean up the edge cases (shared accounts, kiosks, users without smartphones). We do this every day so you don’t have to.

Contact us and we’ll walk through your tenant, flag the risky spots, and get a rollout on the calendar well before Microsoft’s September deadline.

Source: Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID (Microsoft Security Blog, July 13, 2026).

— Adaptive IT

Five years ago, getting cyber insurance was relatively straightforward: answer a short questionnaire, pay a modest premium, and you were covered. Those days are gone. The dramatic increase in ransomware attacks, data breaches, and business email compromise has fundamentally changed the cyber insurance market — and the requirements businesses must meet to obtain and maintain coverage have tightened substantially.

Today, many insurers conduct pre-coverage audits of applicants’ security controls. Renewals include detailed questionnaires that go far deeper than before. And businesses that misrepresent their security posture — even unintentionally — risk having claims denied when they need coverage most.

What Insurers Are Looking For in 2026

Cyber insurance underwriters have become significantly more sophisticated about what security controls actually reduce risk. These are the controls they most commonly require or assess:

Multi-Factor Authentication (MFA)

MFA is now effectively a baseline requirement for cyber insurance. Most insurers require MFA on email, remote access (VPN), privileged accounts, and cloud applications. Some require it broadly across all systems. Businesses without MFA may be unable to obtain coverage at all — or may face significantly higher premiums and lower coverage limits.

Endpoint Detection and Response (EDR)

Traditional antivirus software is no longer sufficient. Insurers increasingly require Endpoint Detection and Response (EDR) solutions — more sophisticated tools that continuously monitor endpoint behavior, detect anomalous activity, and can automatically contain threats. If your business is running basic antivirus, you may not meet current insurer requirements.

Tested Backup and Recovery

Insurers want to know not just that you have backups, but that you’ve tested them. They ask about backup frequency, offsite or cloud storage, air-gapped or immutable backup copies (resistant to ransomware encryption), and recovery time testing. Businesses that can demonstrate a robust, tested backup posture are significantly more attractive to underwriters.

Privileged Access Management

How are administrator accounts managed? Are admin credentials used for day-to-day tasks? Is there a process for managing and auditing privileged access? Insurers are increasingly asking detailed questions about how the most powerful accounts in your environment are controlled.

Email Security

DMARC, DKIM, and SPF records — the email authentication standards that prevent domain spoofing — are increasingly assessed in cyber insurance applications. Advanced email filtering and anti-phishing tools are also commonly required, particularly for businesses in higher-risk industries.

Security Awareness Training

Insurers want to know that your employees have received security awareness training — and increasingly, they want evidence of ongoing training and phishing simulation testing, not just an annual checkbox exercise.

Incident Response Planning

Do you have a documented incident response plan? Have you tested it? Insurers are increasingly requiring businesses to demonstrate that they have a plan for responding to a cyber incident — and that the plan has been reviewed and tested, not just written.

The Consequences of Gaps

Businesses that can’t demonstrate these controls face a range of consequences: inability to obtain coverage, significantly higher premiums, lower coverage limits, higher deductibles, or exclusions that eliminate coverage for the most common attack types. And businesses that answer questionnaires inaccurately — even without intent to deceive — may find their claims denied based on misrepresentation.

How to Prepare

The best way to prepare for a cyber insurance audit is to actually implement the security controls that insurers are looking for — not just to check boxes on a questionnaire. This means working with your IT provider to conduct a genuine security assessment, identify gaps against current insurer requirements, and implement the controls needed to both qualify for coverage and actually reduce your risk.

At Adaptive IT, we regularly help businesses prepare for cyber insurance applications and renewals. We assess your current security posture against insurer requirements, identify and remediate gaps, and provide the documentation that underwriters need — including evidence of MFA deployment, EDR coverage, backup testing, and employee training.

Don’t wait until your renewal to discover that your current controls don’t meet requirements. Contact Adaptive IT today for a cyber insurance readiness assessment and ensure your coverage is in place when you need it most.

A unit of Russia’s military intelligence agency (the GRU group known as APT28 / Fancy Bear / Forest Blizzard — the same group behind the 2016 DNC hack) has been quietly compromising small-office/home-office (SOHO) routers across 23 U.S. states. The FBI disrupted the operation in April under court order, but the underlying vulnerabilities — outdated firmware and unchanged default passwords — are still sitting on thousands of devices waiting to be exploited again. Microsoft tied the campaign to more than 200 organizations and 5,000 consumer devices.

This was a DNS hijacking operation: the attackers changed the routers’ DNS settings so all internet traffic passing through the device got silently redirected through Russian-controlled servers. That gave them passive, persistent visibility into traffic and the ability to harvest credentials at scale. The router sits in the most privileged position on your network — every packet you send goes through it — which is exactly why nation-state actors keep going after them.

Why this matters for your business

The FBI specifically called out the TP-Link TL-WR841N, a Wi-Fi 4 router originally released in 2007. The UK’s National Cyber Security Centre published a broader list of 23 TP-Link models known to have been targeted (and warned the list is likely not exhaustive). TP-Link has confirmed every affected model is past End-of-Life — meaning no more security updates, ever.

If one of these devices is sitting in a closet at your office, the front door of your network is effectively unlocked. Every day it stays plugged in, the risk grows.

Affected routers

• TP-Link LTE Wireless N Router [MR6400]
• TP-Link Wireless Dual Band Gigabit Router [Archer C5, Archer C7, WDR3600, WDR4300]
• TP-Link Wireless Dual Band Router [WDR3500]
• TP-Link Wireless Lite N Router [WR740N, WR740N/WR741ND, WR749N]
• TP-Link Wireless N 3G/4G Router [MR3420]
• TP-Link Wireless N Access Point [WA801ND, WA901ND]
• TP-Link Wireless N Gigabit Router [WR1043ND, WR1045ND]
• TP-Link Wireless N Router [WR840N, WR841HP, WR841N, WR841N/WR841ND, WR842N, WR842ND, WR845N, WR941ND, WR945N]

If you’re running any of these in a business setting, treat it as compromised until proven otherwise. Replace the hardware and rotate any credentials that may have crossed that network — email, VPN, RDP, banking, anything sensitive.

Five steps everyone should take right now

1. Replace any End-of-Life router. If your router stopped getting firmware updates, no amount of tweaking will keep it safe.
2. Update firmware regularly on any router still receiving support — enable automatic updates if the option exists.
3. Change default usernames and passwords. Default credentials are the single most common way attackers get in. Make the admin password long and random.
4. Disable remote management unless you specifically need it. This is one of the primary ways attackers reach into a router from the internet.
5. Reboot routers, computers, and phones at least weekly. Per the NSA: regular reboots help flush implants that live only in memory.

Running one of these in your business? We can help.

If your office is still running a consumer TP-Link (or any other End-of-Life router) for business traffic, Adaptive IT can replace it with enterprise-grade Ubiquiti UniFi equipment — managed switches, access points, and security gateways that get continuous firmware updates, give us central visibility into your network, and are built for business use, not a teenager’s bedroom in 2007.

If you suspect your network may have been touched by this campaign, we can also come in and investigate the damage: DNS log review, credential exposure assessment, lateral-movement checks, and cleanup of any persistence the attackers left behind. The longer you wait, the more time the attackers have to use whatever they harvested.

This is the kind of nation-state-grade attack where waiting and hoping is the most expensive option. Contact us for assistance and we’ll get a network audit on the books this week.

Source: Russia’s Military Hackers Targeted Home Routers Across 23 States. Here’s What to Do (Yahoo Tech / CNET).

— Adaptive IT

Remember when phishing emails were easy to spot? Poor grammar, misspelled words, requests from Nigerian princes, obvious fake logos. Those days are gone. The phishing emails hitting your employees’ inboxes in 2026 are sophisticated, personalized, and in many cases, nearly indistinguishable from legitimate messages — and artificial intelligence is making the problem significantly worse.

What Has Changed

Several converging trends have dramatically raised the quality of phishing attacks:

AI-Generated Content

Large language models can now write phishing emails in any language with perfect grammar, appropriate tone, and context-specific details. The typos and awkward phrasing that used to be reliable red flags have essentially disappeared from sophisticated attacks. A phishing email targeting your CFO can now read exactly like a message from your bank, your attorney, or your CEO.

Personalization at Scale

Attackers now routinely research their targets before launching attacks. LinkedIn profiles, company websites, press releases, social media — all of this public information is harvested to create highly targeted “spear phishing” emails that reference real colleagues, real projects, and real business relationships. An email that mentions your actual vendor by name, references a real ongoing project, and comes from a convincing domain is far more likely to succeed than a generic blast.

Business Email Compromise

Some of the most effective phishing attacks don’t use suspicious links or attachments at all. Business Email Compromise (BEC) attacks involve attackers impersonating executives or trusted vendors — often from lookalike domains or compromised legitimate accounts — to request wire transfers, gift card purchases, or changes to payment details. Because there’s nothing technically malicious in the email, security tools often miss them entirely.

QR Code and Voice Phishing

“Quishing” (QR code phishing) embeds malicious URLs in QR codes, bypassing link-scanning security tools entirely. Voice phishing (“vishing”) uses AI-cloned voices to call employees and impersonate executives or IT support — some organizations have been defrauded of hundreds of thousands of dollars through a single phone call.

Why Traditional Training Isn’t Enough

Annual security awareness training that teaches employees to look for bad grammar and suspicious links is fighting the last war. Today’s phishing attacks don’t have those tells. Even well-trained, vigilant employees are fooled by sophisticated spear phishing — because the attacks are designed specifically to defeat human judgment.

This doesn’t mean training is useless — it means training needs to evolve. Effective security awareness programs in 2026 use realistic phishing simulations that mirror current attack techniques, deliver training in the moment when employees make mistakes, and focus on behavioral patterns rather than specific indicators.

A Layered Defense Against Modern Phishing

Because no single control stops all phishing attacks, effective protection requires multiple layers working together:

• Email security filtering — Advanced tools that use AI to detect suspicious patterns, analyze sender reputation, and sandbox attachments and links before delivery
• DMARC enforcement — Prevents attackers from spoofing your domain, protecting your customers and partners from impersonation attacks in your name
• Multi-factor authentication — Even if credentials are phished, MFA prevents attackers from accessing accounts
• Realistic security awareness training — Ongoing simulations using current attack techniques, not outdated examples
• Clear verification processes — Documented procedures for verifying wire transfers, payment changes, and sensitive requests through out-of-band channels (phone calls to known numbers)
• Incident response readiness — A clear plan for what employees should do when they suspect they’ve been phished

What To Do If You Suspect a Phishing Attempt

Train your team on these immediate steps: don’t click any links or open attachments, don’t reply to the email, report it to your IT team immediately, and if credentials were entered anywhere, assume the account is compromised and change passwords immediately while notifying IT.

Speed matters. The faster a phishing incident is reported, the faster it can be contained before it becomes a full breach.

Adaptive IT provides comprehensive email security and cybersecurity training designed for the threats businesses face today — not the threats of five years ago. Contact our team to learn how we can protect your business from modern phishing attacks.

Microsoft 365 is one of the most secure productivity platforms on the market. It comes packed with sophisticated security tools, compliance features, and threat protection capabilities. There’s just one problem: most of them are not turned on by default.

Out of the box, Microsoft 365 is configured for ease of use and broad compatibility — not maximum security. That makes it accessible for new users, but it also means thousands of businesses are running Microsoft 365 every day with critical security gaps they don’t know exist. Here are the most common and consequential settings we find missing when we audit a new client’s environment.

1. Multi-Factor Authentication (MFA) Is Not Enforced

This is the single most impactful security control available in Microsoft 365 — and it’s consistently the most underdeployed. MFA requires users to verify their identity with a second factor (an app notification, a code, a hardware key) in addition to their password.

Microsoft’s own data shows that MFA blocks 99.9% of account compromise attacks. Even if an attacker has a user’s password through phishing or a data breach, MFA stops them from accessing the account. Despite this, many organizations have MFA available but not required — leaving accounts vulnerable to exactly the attacks it was designed to prevent.

2. Legacy Authentication Protocols Are Still Enabled

Older email protocols — IMAP, POP3, SMTP Auth, and Basic Authentication — don’t support MFA. If these protocols are enabled in your tenant, attackers can bypass MFA entirely by targeting legacy authentication endpoints. Many breaches that occur in “MFA-protected” environments exploit exactly this gap.

Blocking legacy authentication is one of the most effective steps you can take to protect your Microsoft 365 environment — but it requires careful configuration to avoid disrupting legitimate users and systems.

3. Microsoft Defender for Office 365 Features Are Underutilized

Microsoft 365 Business Premium and higher plans include Defender for Office 365, which provides powerful protection against email threats. However, its most effective features require explicit configuration:

• Safe Links — rewrites URLs in emails and documents and checks them in real time when clicked, blocking malicious links even after they’ve been delivered
• Safe Attachments — detonates attachments in a sandbox environment before delivery to detect malware that evades traditional signature-based detection
• Anti-phishing policies — detects impersonation attempts of your executives, domains, and trusted senders

These features can be configured in minutes and dramatically reduce the risk of email-based attacks — but they require someone to actually configure them.

4. Audit Logging Is Disabled

Microsoft 365 can log virtually every action taken in your environment — who signed in from where, which emails were accessed, what files were downloaded, when admin settings were changed. This audit trail is invaluable for detecting suspicious activity and investigating incidents after they occur.

However, unified audit logging must be explicitly enabled. Without it, you’re flying blind — and you may not know an account was compromised until months after the fact.

5. Admin Accounts Are Used for Daily Tasks

Global Administrator accounts in Microsoft 365 have unrestricted access to everything in your tenant. Using these accounts for day-to-day tasks — reading email, attending meetings, browsing the web — unnecessarily exposes your most powerful credentials to everyday risks.

Best practice is to create separate, dedicated admin accounts used only for administrative tasks, while daily work happens in standard user accounts with minimal permissions. Ideally, admin accounts should also use hardware security keys rather than software MFA.

6. Conditional Access Policies Are Not Configured

Conditional Access is one of Microsoft 365’s most powerful security features. It allows you to define rules for when and how users can access company resources — requiring MFA when logging in from new locations, blocking access from certain countries, requiring compliant devices for sensitive applications.

Without Conditional Access policies, a user’s credentials are the only barrier between an attacker and your organization’s data — regardless of where the attacker is or what device they’re using.

Get a Microsoft 365 Security Assessment

These six settings represent the most common and consequential security gaps we find in Microsoft 365 environments — but they’re far from the only ones. A comprehensive security configuration review covers dozens of additional settings across identity, email, endpoint, and data protection.

Adaptive IT provides Microsoft 365 security assessments and ongoing configuration management as part of our Managed Security Services. We review your tenant against Microsoft’s security benchmarks, identify gaps, and implement the right controls — without disrupting your team’s productivity.

Contact us today to schedule your Microsoft 365 security review.

When most business owners think about ransomware, they picture large corporations making headline news after paying million-dollar ransoms. The reality is far more sobering: small and medium-sized businesses are the primary target of ransomware attacks, accounting for over 70% of all incidents. And for most of them, the financial impact is devastating — not just from the ransom itself, but from a cascade of costs that most business owners never anticipate.

The Ransom Is Just the Beginning

The average ransom demand for a small business in 2026 sits between $50,000 and $200,000. Many victims pay, believing it’s the fastest path back to normal operations. But payment guarantees nothing. Decryption tools provided by attackers are often slow, incomplete, or broken. And paying once makes you a known target for future attacks.

The ransom is typically the smallest part of the total cost. Here’s what the real bill looks like:

1. Downtime Costs

The average ransomware recovery time for a small business is 21 days. For a business generating $500,000 annually, that’s nearly $29,000 in lost revenue — before accounting for the employees who can’t work, the customers who can’t be served, and the contracts that may be lost permanently.

2. Recovery and Remediation

Recovering from a ransomware attack isn’t as simple as restoring a backup. Forensic investigation to understand how attackers got in, rebuilding compromised systems, re-imaging every affected device, and verifying that no backdoors remain — these costs add up quickly. Emergency IT response rates are significantly higher than regular service rates, and recovery often requires specialist expertise.

3. Data Loss

If your backups haven’t been tested, there’s a real possibility that some or all of your data is unrecoverable. Customer records, financial data, years of documents — gone permanently. The cost of recreating or losing this data can dwarf the ransom demand.

4. Regulatory and Legal Exposure

If your business handles personal data — and nearly every business does — a ransomware attack is also a data breach. This triggers notification requirements, potential regulatory fines, and possible civil liability. Healthcare practices face HIPAA consequences. Financial advisors face SEC and FINRA scrutiny. Legal fees alone can exceed six figures.

5. Reputational Damage

Clients and partners who learn their data was compromised don’t always stay. Trust, once broken, is difficult and expensive to rebuild. The long-term revenue impact of lost relationships can persist for years after the incident itself.

What Does a Ransomware Attack Actually Cost?

Adding it all together, the total cost of a ransomware attack on a small business typically ranges from $150,000 to $500,000 or more — and 60% of small businesses that suffer a major attack close within six months. That’s not a statistic about large corporations. That’s your competitors, your neighbors, and businesses just like yours.

Prevention Costs a Fraction of Recovery

The tools and practices that prevent ransomware attacks — endpoint detection and response, email security, regular tested backups, employee training, and multi-factor authentication — cost a small fraction of what a single attack would cost. Managed Security Services give small businesses access to enterprise-grade protection at a predictable monthly cost, typically far less than one day of downtime from a successful attack.

At Adaptive IT, we specialize in building layered security defenses that protect small and medium-sized businesses from ransomware and other cyber threats. From endpoint protection to immutable backup solutions to employee security awareness training, we provide the full stack of protection your business needs.

Don’t wait for an attack to find out what it would cost. Contact our team for a free security assessment and discover where your business is most vulnerable — before an attacker does.

Every day, thousands of businesses send and receive emails without realizing that anyone — a cybercriminal, a scammer, or a competitor — can send an email that appears to come from their domain. No hacking required. No special access needed. Just a simple technical gap that most businesses don’t know exists.

That gap is the absence of DMARC. And closing it is one of the most important steps any business can take to protect its email reputation, its clients, and its brand.

What Is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It is an email authentication protocol that tells receiving mail servers what to do when an email claims to be from your domain but fails authentication checks.

DMARC works alongside two other email authentication standards:

• SPF (Sender Policy Framework) — specifies which mail servers are authorized to send email on behalf of your domain.
• DKIM (DomainKeys Identified Mail) — adds a digital signature to outgoing emails so recipients can verify the message wasn’t tampered with in transit.

DMARC ties these two systems together. If an email fails SPF or DKIM checks, your DMARC policy tells the receiving server whether to deliver it, quarantine it (send it to spam), or reject it entirely.

Why Does This Matter for Your Business?

Without DMARC, your domain is an open target for a technique called email spoofing — where attackers forge the “From” address of an email to make it appear to come from your company.

Imagine your clients receiving an email that looks exactly like it came from you — correct logo, correct domain, correct tone — asking them to wire money, update payment details, or click a link to “verify their account.” This is not a hypothetical. Business Email Compromise (BEC) attacks cost organizations over $2.9 billion in 2023 according to the FBI’s Internet Crime Report.

Your clients trust your email address. Attackers exploit that trust. DMARC removes the ability for them to do so.

The Three DMARC Policies

DMARC gives you control over what happens to unauthenticated emails through three policy levels:

1. p=none — Monitor mode. Unauthenticated emails are still delivered, but you receive reports about them. Good starting point to understand your email ecosystem.
2. p=quarantine — Unauthenticated emails are sent to the recipient’s spam or junk folder. Provides protection while minimizing the risk of blocking legitimate mail.
3. p=reject — Unauthenticated emails are rejected outright and never reach the recipient. This is full protection and the end goal for most businesses.

How Do You Know If You’re Protected?

The fastest way to find out is to use a free email domain security scanner. Simply enter your domain and check whether SPF, DKIM, and DMARC records are properly configured — and whether your DMARC policy is actually enforcing protection (p=quarantine or p=reject) rather than just monitoring.

Many businesses are surprised to find they have no DMARC record at all, or that their policy is set to “none” — meaning they’re getting visibility into spoofing attempts but doing nothing to stop them.

What Happens After You Implement DMARC?

Once DMARC is properly configured and enforced, you gain:

• Email spoofing protection — bad actors can no longer impersonate your domain
• Improved email deliverability — authenticated emails are more likely to reach inboxes
• Visibility through reporting — DMARC reports show you everywhere your domain is being used (and misused)
• Brand protection — your clients receive only legitimate emails from your domain
• Compliance support — many cyber insurance policies and regulatory frameworks now require DMARC

Getting Started

Implementing DMARC correctly requires careful configuration of your DNS records, a thorough understanding of all legitimate email sending sources for your domain, and a gradual policy rollout to avoid disrupting legitimate mail flow. Rushing the process can result in blocking your own emails — something no business wants.

At Adaptive IT, we handle DMARC implementation as part of our Managed Security services. We configure your SPF, DKIM, and DMARC records correctly from the start, monitor your DMARC reports, and help you move safely from p=none to p=reject — closing the spoofing gap completely.

Not sure where your domain stands right now? Use our free email domain security scanner to check your SPF, DKIM, and DMARC configuration in seconds. It’s free, instant, and requires no signup.

Or contact our team to schedule a free security assessment and find out exactly what’s needed to fully protect your business email.