800-214-0957 info@blackbottleit.com
How a Small Business Protects Against Cyber Threats: What’s Changed and What Hasn’t

How a Small Business Protects Against Cyber Threats: What’s Changed and What Hasn’t

by | Nov 5, 2026 | AI, Cybersecurity

“The more things change, the more they stay the same.” When we first wrote this post in early 2024, the point was simple: new technology keeps arriving, but the threats that hurt small businesses most stay remarkably familiar. Nearly three years later, that’s still true, with one big twist. Attackers now use AI to run the same old scams faster, cheaper and far more convincingly.

For small business owners, the question has shifted from whether you’ll be targeted to how ready you’ll be when it happens. Here’s what has changed, what hasn’t, and the practical steps that protect a small business in 2026.

How does a small business protect against cyber threats? A small business protects against cyber threats by layering a few proven defenses: multi-factor authentication on every account, phone verification of payment requests, regular staff training, tested backups, automatic patching, monitored endpoint security, limited access, an AI-use policy and a practiced incident response plan. None of these require an enterprise budget, and together they stop most attacks.

How a small business protects against cyber threats: 10 layers

No single tool stops a modern attack. Protection comes from layers, so that when one fails, the next one catches it. These are the layers we recommend for every small business:

 

  1. Turn on multi-factor authentication everywhere. Start with email, banking, payroll, cloud apps and remote access. Phishing-resistant options like authenticator apps or security keys beat text-message codes.
  2. Verify every money request out of band. Any new or changed payment instruction, urgent wire or “CEO request” gets confirmed by calling a known number, never the one in the email. This one habit defeats most BEC and deepfake scams.
  3. Train your team for AI-era phishing. Run short, regular awareness training and simulated phishing tests. Teach staff that a polished message or a familiar voice is no longer proof of anything.
  4. Back up, and test your backups. Follow the 3-2-1 rule: three copies, on two types of media, with one offline or immutable. A backup you’ve never restored is a backup you can’t count on.
  5. Keep everything patched. Turn on automatic updates for operating systems, browsers and business apps. Retire devices and software that no longer get security updates.
  6. Protect every device with monitored endpoint security. Endpoint detection and response (EDR), watched around the clock, spots ransomware and intruders that antivirus alone misses.
  7. Limit access. Give people only the access their job requires, remove accounts promptly when staff leave, and keep admin rights separate from everyday logins.
  8. Set rules for AI use. Write a simple policy on which AI tools are approved and what data must never go into them.
  9. Have an incident response plan. Know who to call, how to isolate systems and how to keep operating. Practice it once a year with a tabletop exercise, including a fake “CEO voice” call.
  10. Know your vendors and your insurance. Ask key vendors how they protect your data, and review what your cyber insurance requires. Many policies now require MFA, EDR and tested backups to pay a claim.

Free resources from the experts

You don’t have to build a security program from scratch. Federal agencies publish free, plain-language guidance written specifically for small businesses:

  • NIST Small Business Cybersecurity Corner — NIST’s one-stop hub of free guides, videos and planning tools for small businesses, including ransomware and supply chain resources.
  • NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide — a short introduction to organizing your security around the framework’s core functions.
  • NIST’s new draft guide for very small firms — in April 2026, NIST released a draft update to its long-running small business guidance (CSWP 50), aimed at owner-operated businesses with little IT complexity (NIST).
  • CISA Cyber Essentials — a practical starting point from the Cybersecurity and Infrastructure Security Agency, built for organizations where the owner is also the IT department.

 

Small business cybersecurity FAQ

 

What is the biggest cyber threat to a small business in 2026?

Phishing and business email compromise. AI now makes these messages polished and personal, and BEC alone cost U.S. victims about $3 billion in 2025. Verifying payment requests by phone is the single most effective defense.

 

How can a small business protect against cyber threats on a tight budget?

Start with the free and low-cost basics: turn on multi-factor authentication, enable automatic updates, keep an offline backup and verify payment changes by phone. NIST and CISA publish free step-by-step guides written for small businesses.

 

Is my business too small to be a target?

No. Most attacks are automated and scan for weak spots, not company size. Smaller firms are often hit precisely because they have fewer defenses.

 

When should a small business outsource cybersecurity?

When no one on staff can watch for alerts around the clock, when an insurer or regulator requires controls like MFA and EDR, or when a breach would halt operations. A managed security provider gives you full-time monitoring without a full-time hire.

The bottom line

 

AI has changed how attacks look, but not where they land, and that’s good news for any small business protecting against cyber threats. Phishing, stolen logins, ransomware and unpatched systems are still the front doors, and layered fundamentals still lock them. The difference in 2026 is speed: attackers move faster, so your defenses and your response have to be ready before something happens.

 

Most small business owners don’t have time to monitor threats around the clock, and they shouldn’t have to. Black Bottle IT helps small businesses put these layers in place and keeps watch so you can focus on running your business.

 

If you’d like to outsource your cybersecurity or get a quick assessment of where you stand, contact us today or call 800-214-0957.

Cyber Threats and Law Firms

Cyber Threats and Law Firms

by | Nov 4, 2026 | Cybersecurity

Why Law Firms Are Prime Cyber Targets in 2026 — and How to Protect Your Practice

· @Paulette Duderstadt

Confidentiality is the core of what you do. You hold privileged conversations, guard case strategy, and protect every client file. But today’s attackers don’t pick locks or steal folders. They send a convincing email, call your front desk pretending to be IT, or walk in with a USB drive.

In 2026, law firms are among the most targeted businesses in the country, and cybersecurity has moved from “IT best practice” to a professional and legal obligation. Here’s why it matters, why your firm is a target, and the concrete steps that protect your practice today.

Protecting client data is no longer just good client service. It is part of your professional obligations, and regulators and bar authorities expect you to show your work.

  • Technology competence (ABA Model Rule 1.1, Comment 8). Lawyers must keep up with the benefits and risks of the technology they use. Most states have adopted this standard, so “I’m not a tech person” is no longer a defense.
  • Reasonable safeguards (Rule 1.6(c)). Firms must make reasonable efforts to prevent unauthorized access to client information. ABA Formal Opinion 477R explains that “reasonable” scales with the sensitivity of the data, and it includes vetting your technology vendors.
  • Breach response (Formal Opinion 483). Lawyers must monitor for attacks, act quickly to stop a breach, and tell clients when their information is compromised. In practice, that means having an incident response plan before you need one.
  • Remote and virtual practice (Formal Opinion 498). Working from home, a client site or a phone carries the same confidentiality duties as working at the office.
  • Generative AI (Formal Opinion 512, July 2024). Before entering client information into an AI tool, lawyers must understand how the tool stores and uses that data, and in many cases get the client’s informed consent. Firms need a written AI use policy.

Pennsylvania adds its own requirements. Since September 26, 2024, the Breach of Personal Information Notification Act requires organizations to notify the Attorney General when a breach affects more than 500 Pennsylvania residents. It also requires 12 months of free credit monitoring when certain data, such as Social Security, bank account or driver’s license numbers, is exposed.

Clients notice, too. In 2025, 37% of legal clients said they would pay more for a firm with stronger cybersecurity. Strong security wins business; weak security loses it.

Why Law Firms Are Prime Targets

Criminals go where the valuable data is, and few businesses hold more of it per file than a law firm: privileged communications, financial records, deal terms, medical records and litigation strategy. That data is worth stealing, and firms face strong pressure to pay quickly and quietly.

The numbers show it:

The FBI has warned law firms directly. A criminal group known as Silent Ransom Group (also called Luna Moth) has targeted U.S. law firms since 2023. Its staff call employees pretending to be the firm’s IT support, talk them into allowing “remote maintenance,” then steal data and demand payment. In May 2026, the FBI warned the group is now showing up at offices in person, posing as technicians to plug USB drives into firm computers.

Common weak points we still see at firms:

  • Remote and hybrid work on home networks and personal devices
  • Outdated systems and unpatched remote-access tools, a favorite entry point for ransomware groups
  • AI-powered phishing that is now nearly indistinguishable from a real client or vendor email
  • No written incident response plan, so the first hours of an attack are lost to confusion

How to Protect Your Firm: The 2026 Baseline

These are the controls bar regulators, cyber insurers and sophisticated clients now expect. Most can be in place within weeks with the right partner.

  1. Use phishing-resistant multi-factor authentication everywhere. Security questions and text-message codes are no longer enough. Use an authenticator app, passkeys or hardware security keys on email, document management, billing and remote access.
  2. Verify every “IT support” request. Set a simple rule: no one gets remote access or physical access to a firm computer until their identity is confirmed through a known number. Train the front desk to check credentials of any visiting technician.
  3. Run 24/7 monitoring and endpoint detection and response (EDR). Antivirus and spam filters alone miss modern attacks. Managed EDR watches every device and can isolate a compromised laptop in minutes.
  4. Patch on a schedule. Update operating systems, VPNs and remote-access tools promptly, especially when a critical vulnerability is announced.
  5. Keep backups attackers can’t touch. Use automated, encrypted, offsite backups with an immutable copy, and test restoring them.
  6. Write and test an incident response plan. Name who does what, which outside counsel and forensics firm you’ll call, and how you’ll meet client and Pennsylvania notification duties. Rehearse it once a year.
  7. Adopt a written AI use policy. Approve specific tools, define what client information may never be entered, and document client consent where Opinion 512 requires it.
  8. Secure remote work. Require firm-managed devices, encrypted connections and secure client portals instead of email attachments for sensitive files.
  9. Vet your vendors. Confirm that your cloud, e-discovery, billing and AI providers protect data to the standard your clients expect.
  10. Train your people regularly. Short, frequent phishing and social engineering training, including phone scams, beats a once-a-year slideshow.
  11. Review your cyber insurance. Insurers now require MFA, EDR and tested backups before they’ll pay. Make sure your controls match your policy.

Get Your Free Security Plan Review

You don’t need an in-house security team to meet today’s standards. You need a partner who understands both the technology and the ethics rules behind it.

Black Bottle IT provides fully managed IT and cybersecurity for law firms, with 24/7 monitoring, rapid incident response and secure solutions for both office and remote work.

Start with a Free Security Plan Review. In a short, no-obligation session, we’ll:

  • Assess your current security against the 2026 baseline above
  • Flag your biggest risks, from phishing and fake IT calls to unpatched systems
  • Review your readiness for a breach and your notification obligations
  • Give you a clear, prioritized plan in plain English

Schedule your Free Security Plan Review or call 800-214-0957. Protect your clients, your license and your reputation, starting today.

 

 

 

 

 

 

Sources

Cybersecurity and Remote Workforce

Cybersecurity and Remote Workforce

by | Oct 1, 2026 | Cybersecurity

Cybersecurity for Your Remote Workforce

A remote workforce is no longer the exception. For many companies, it’s simply how business gets done.

That flexibility comes with a cost: cybersecurity is now the top concern across the technology industry. Remote employees often assume their home is a safe place to work. Companies need to educate their teams about cybersecurity and give them the protection they need.

Read on to learn more about this critical issue.

The Rise of the Remote Workforce

The COVID-19 pandemic was the turning point. Almost overnight, companies moved their teams out of the office and into virtual work environments. What started as a temporary fix became a lasting change, driven by lower real estate costs, employee demand for flexibility, and access to a wider talent pool.

But the rapid shift also opened the door to a wave of cyberattacks, many of which exploited gaps in email and endpoint security. Those risks haven’t gone away.

Cybersecurity Risks of a Remote Workforce

Why does remote work increase risk? In a traditional office, IT managers control the Wi-Fi network. Most home networks have weaker security protocols, which makes it easier for hackers to access network traffic.

Phishing remains the leading cause of data breaches. These attacks look legitimate, using convincing emails loaded with dangerous links and attachments. It only takes one employee clicking a link for a hacker to gain access to their computer. Once that employee connects to the company network, the cybercriminal can get in too. One click can bring your business to a standstill.

Another risk is cutting corners: systems that aren’t encrypted, accounts without two-factor authentication, or lax password practices. It’s not worth the risk. Make sure every remote worker uses encryption and two-factor authentication, especially when accessing the main network.

Establish password standards and enforce changes on a set schedule. Many experts also recommend moving from hardware-based legacy VPNs, which can leave vulnerabilities, to cloud-agnostic, scalable solutions.

How to Reduce Risk Across Your Remote Workforce

Educate employees on cybersecurity and track their compliance with your security standards. Training should teach them to recognize the signs of a breach, including:

  • Unexpected installation of new programs
  • Noticeably slower computer performance
  • Odd pop-up ads appearing on screen
  • Losing control of the keyboard or mouse

The best practice is to hold regular virtual training sessions for all employees, with updates on the latest cyberattack strategies.

Also, reinforce the importance of staying vigilant while working remotely. Remind employees that no one else should use a company-provided computer for any reason, even though that can be tempting at home.

Do You Have a Remote Workforce?

Does your company have a remote or hybrid workforce? Are you meeting the cybersecurity standards described in this article?

Black Bottle IT offers next-generation security solutions to keep your remote workforce protected and compliant. We continuously monitor for vulnerabilities and attacks because we know protecting your customer data is the highest priority.

Contact us today to talk about your cybersecurity compliance needs. 

Testing Backups

by | Sep 15, 2026 | Compliance, Cybersecurity, Uncategorized

Backups Are Only Half the Story: Why Testing Is What Actually Protects Your Business

Backups are essential for every business — they’re your safety net when critical systems fail. But backups alone aren’t enough; regular testing is what makes them reliable.

“We see too many businesses treat backups as set it and forget it… until the day they need them and discover something went wrong.” ~ Michael Valentine

Keep your Disaster Recovery Plan (DRP) up to date. It’s a small effort now that could save you countless headaches later.

Why “Having a Backup” Isn’t the Same as “Being Protected”

Most businesses know they need backups. Far fewer know whether their backups actually work. A backup that’s never been restored isn’t a safety net — it’s a guess. You won’t find out it’s broken until you’re already in a crisis, trying to get systems back up.

That’s the gap between having a backup and having a recovery plan you can trust.

What You Need to Know — and Do

Here are the best practices every business should have in place:

1. Follow the 3-2-1 rule. Keep at least three copies of your data, on two different types of media, with one copy stored offsite (or in the cloud). This protects you against hardware failure, ransomware, theft, and site-level disasters alike.

2. Automate your backups. Manual backups get forgotten, delayed, or skipped. Automated, scheduled backups remove human error from the equation and ensure nothing critical slips through the cracks.

3. Test your backups — not just once, but on a schedule. A backup that’s never been restored isn’t a safety net — it’s a guess. You won’t find out it’s broken until you’re already in a crisis, trying to get systems back up. Restore testing turns backups from a checkbox into an actual part of your security posture.

4. Know your Recovery Time Objective (RTO) and Recovery Point Objective (RPO). RTO is how quickly you need systems back online. RPO is how much data loss you can tolerate. If you don’t know these numbers for your business, you don’t actually know how prepared you are.

5. Keep an offline or immutable copy. Ransomware increasingly targets backups directly. An offline, air-gapped, or immutable backup copy ensures attackers can’t encrypt or delete your last line of defense.

6. Update your Disaster Recovery Plan (DRP) regularly. Systems, staff, vendors, and priorities change — your DRP should change with them. A DRP that reflects last year’s infrastructure won’t help you today.

7. Document the recovery process — and who’s responsible. When something goes wrong, there’s no time to figure out who does what. A clear, written recovery process removes guesswork under pressure.

The Bottom Line

Backups protect you only if they work when you need them — and the only way to know that is to test them. Treat your backup strategy as an ongoing discipline, not a one-time setup, and your DRP as a living document, not a file that sits untouched until disaster strikes.

Cybersecurity for Managing Partners

Cybersecurity for Managing Partners

by | Feb 9, 2026 | Compliance, Cybersecurity

Cybersecurity for Managing Partners: Your Fiduciary Duty to Protect Client Data

As a managing partner, you’re responsible for more than just billable hours and client development. You bear the fiduciary duty to protect your firm from threats that could end careers, drain bank accounts, and destroy decades of reputation-building. Cybersecurity isn’t just an IT issue—it’s a risk management imperative that belongs on every managing partner’s desk.

The Threat Landscape Facing Law Firms Today

Law firms have become prime targets for cybercriminals, and the statistics are sobering. According to the ABA’s Legal Technology Survey, 29% of law firms experienced a security breach in the past year. Unlike other industries where hackers seek credit card numbers or personal data, attackers targeting law firms are after something far more valuable: privileged client information, M&A deal terms, litigation strategy, intellectual property, and wire transfer credentials.

Your firm holds the keys to the kingdom for your clients’ most sensitive matters. A single compromised email account can expose:

  • Confidential settlement negotiations worth millions
  • Upcoming merger announcements that could be used for insider trading
  • Trade secrets and patent applications
  • Attorney-client privileged communications
  • Trust account wire transfer access

The consequences extend beyond the immediate breach. Law firms face malpractice claims, bar discipline, loss of client trust, mandatory breach notifications, regulatory fines, and the devastating reputational damage that comes when clients learn their confidential information was compromised under your watch.

Your Ethical and Legal Obligations

Many managing partners don’t realize that cybersecurity is no longer optional—it’s an ethical requirement imposed by your state bar.

Model Rule 1.6(c) requires attorneys to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” State bars and courts have consistently interpreted this to include implementing reasonable cybersecurity measures.

But what does “reasonable” actually mean? That’s where managing partners often struggle. The ambiguity has led to inconsistent approaches across firms, with some doing the bare minimum and others over-investing in unnecessary tools.

State bars have begun providing more specific guidance:

  • New York requires attorneys to complete cybersecurity CLE training annually
  • North Carolina has issued formal ethics opinions on cloud computing security and data breach response
  • California and Florida bars have published detailed guidance on encryption, secure communication, and vendor management

The trend is clear: bars expect more from firms regarding data protection, and “we didn’t know” is no longer an acceptable defense.

Beyond Bar Requirements: Client Demands

Even if ethical obligations seem vague, your clients are and will be increasingly specific about their security expectations! Law firms can and should routinely send detailed vendor security questionnaires to their outside counsel.

These cybersecurity assessments ask about:

  • Encryption standards for data at rest and in transit
  • Multi-factor authentication implementation
  • Incident response procedures and breach notification protocols
  • Employee security awareness training programs
  • Third-party vendor risk management
  • Business continuity and disaster recovery plans
  • Whether you maintain certifications like SOC 2 or ISO 27001

Firms that can’t demonstrate adequate security controls are losing opportunities.

Law firms can be removed from RFP shortlists solely because they couldn’t certify their security posture. In competitive markets, security has become a differentiator—not just a compliance checkbox.

Investing in Cybersecurity

Your clients trust you with their most sensitive matters. Your partners have built their careers on the firm’s reputation. Your staff depend on the firm’s stability for their livelihoods. Protecting all of that from cyber threats isn’t optional—it’s your fundamental duty as a managing partner.

The question isn’t whether you can afford to invest in cybersecurity. The question is whether you can afford not to.

Black Bottle IT helps law firms meet their ethical duty to protect client data without the cost of a full-time security team. We implement the cybersecurity standards your bar requires and your corporate clients demand—so you can focus on practicing law, not IT compliance.

Payroll Companies are a Lucrative Business for Hackers

Payroll Companies are a Lucrative Business for Hackers

by | Jan 24, 2026 | Compliance, Cybersecurity, Risk Management

Payroll Companies Remain Prime Targets for Cybercriminals

As we enter 2026, the cybersecurity landscape for accounting firms, payroll providers, and tax preparers has never been more complex—or more critical. With regulatory requirements tightening and threat actors growing more sophisticated, compliance is no longer just about checking boxes. It’s about building a cyber-resilient operation that protects your clients’ most sensitive data while keeping your business operational.

The FTC Safeguards Rule, state data privacy laws, and industry-specific compliance mandates continue to evolve, placing greater responsibility on financial services professionals to demonstrate robust security measures. Yet many firms still treat their Written Information Security Plan (WISP) as a document that sits on a shelf rather than a living, breathing framework for daily operations.

Here’s the reality: Payroll and accounting firms hold the keys to the kingdom—Social Security numbers, bank account details, tax records, and financial histories. For cybercriminals, you’re not just a target; you’re a goldmine. And if your cybersecurity program isn’t actively identifying, prioritizing, and addressing vulnerabilities, you’re leaving the door wide open.

Questions Only You Can Answer About Your WISP Plan

Your WISP Can’t Just Sit on a Shelf!

  • Have you performed an Annual Risk Assessment?
  • Do you have an Incident Response Plan, and have you TESTED IT?
  • Has your organization implemented Advanced Security Controls?
  • Do you have a Cybersecurity Awareness Training Program?
  • Who is your CISO; one must be identified in your WISP!
  • Do you know what systems contain sensitive client data and how it’s protected?
  • What’s your process to communicate your plan across the organization?

There’s no time for complacency. Failure to comply could subject your organization to legal liability, regulatory penalties, client lawsuits, and reputational damage that takes years to repair.

Let’s Dive a Bit Deeper with AV & EDR: A Better Core Control

Traditional Anti-Virus (AV)

  • Can only detect previously known threats
  • Minimal to no data collection
  • Minimal to no added features or benefits

Endpoint Detection & Response (EDR)

  • Can detect previously known AND unknown threats due to behavioral-based monitoring
  • Complex and detailed endpoint data collection
  • Added benefits include application monitoring, threat-hunting capabilities, and advanced reporting

Wouldn’t it be nice to know at which bend in the road your business might encounter a breach?

Your Preparedness Should Include:

  • An updated WISP and tested Incident Response Plan
  • Employees who are current on cybersecurity awareness training
  • Multi-Factor Authentication (MFA) on every device and application
  • 24×7 monitoring of all systems and endpoints
  • A comprehensive Cyber Insurance policy

As a whole industry, we’re improving. Training initiatives are making a difference—breaches caused by human error continue to decline. But bad actors aren’t just after your data; they’re after your money. Payroll companies remain lucrative targets because of the direct access to bank accounts, wire transfers, and financial credentials.

Compliance and Cyber Resilience Go Hand-in-Hand

Black Bottle IT specializes in helping payroll companies, accounting firms, and tax preparers meet compliance requirements while building truly resilient cybersecurity programs. We don’t just help you pass an audit—we help you protect your business and your clients every single day.

Ready to strengthen your defenses in 2026? Contact Black Bottle IT today. We have a bench of cyber analysts ready to fight alongside you.

Key changes made:

  • Updated intro with 2026 context and current compliance landscape
  • Emphasized the evolving regulatory environment (FTC Safeguards Rule, state privacy laws)
  • Maintained all core technical content while refreshing the tone to be more urgent and relevant
  • Strengthened the call-to-action with partnership language

To get started, contact Black Bottle IT today. Our team is ready to support your business’s growth.