6 Months In: The Good, the Bad and the Ugly

Six months in. I gave an intern with no compliance background our hardest question, and working about a day a week over roughly eleven weeks he drove 31 of 34…

Watching someone who knew almost nothing walk your product to the finish feels like making value out of thin air. That is the magic every founder chases.

What CyFun actually is → https://easycyberprotection.com/learn/cyberfundamentals/what-is/

Wax On, Wax Off

Mr. Miyagi was right in The Karate Kid: the boring repetition is the whole point.

The security was there. The paperwork was not, and the paperwork is what fails audits.

• The platform: drafts the policies, pulls the evidence, flags what is missing. Think scoreboard, not gym: it shows you what to fix and proves it once you have.
• The human: still decides what those policies actually say. That part is slow, and there is no shortcut for it.
• Off the platform: the real fixes: MFA, backups, firewalls, running the procedures. At an MSP these were already largely in place, which is why deciding the policies and judging the evidence was the real job here. A fresh client still has the securing to do, and it is usually the bigger part.

Why an MSP should offer compliance → https://easycyberprotection.com/learn/guides/why-msp-offer-compliance/

"Lower Than Yours, Apparently"

"What's your trust setting, TARS?" "Lower than yours, apparently." (Interstellar, and yes, ours is named after it.)

— T.A.R.S.

What's your trust setting, TARS?" "Lower than yours, apparently." (Interstellar, and yes, ours is named after it.) Once an issue, our in-house AI gets the floor, the same model that drafts your compliance policies, off…

I'm Sorry, Dave. I'm Afraid I Can't Do That.

"I'm sorry, Dave. I'm afraid I can't do that." HAL 9000 said it ominously in 2001: A Space Odyssey. Mine says it when I am about to ship something dumb.

People ask how a near-solo shop ships this fast. The trick is not the AI; it is the feedback loops around it.

• Draft with Claude.
• Review with our own Cloudflare models (never ChatGPT).
• Human sign-off before anything ships.

I'll Be Back

"I'll be back." The Terminator meant it, and so does every attacker, usually through a door you forgot to lock.

We read all 25 issues so you do not have to.

• The back door beat the front door. A ticketing vendor, a hospital supplier, a booking system behind 100+ hotels. You inherit your suppliers' security.
• Ransomware went SME-shaped. The crews working Belgium target small firms on purpose. For a stretch this spring, a named Belgian victim almost every week.
• MFA bypass is the new frontier. The Tycoon 2FA service alone had around 500 Belgian victims before Europol shut it down.

What the back door usually leads to → https://easycyberprotection.com/learn/basics/ransomware/

Next Thursday: State Security, Breached Through the Back Door

Normal service resumes next week.

• Belgium's State Security breached through a supplier's flaw (the back door, live).
• A CCB patch roundup where one of the worst bugs sits inside an RMM (remote monitoring and management) tool that MSPs run themselves.
• The CCB's new "Fraudstop" emergency number for fraud and phishing, worth handing to clients.