Scams that look like routine, and AI that answers the phone.
Four things worth five minutes of your time this month, and one thing worth doing before the end of the week.
This issue went out by email on . Archived here so it can be linked, searched and read without an inbox.
Two of the items below are variations on the same theme: attackers have stopped trying to look unusual and started trying to look routine. A verification box. An update prompt. An alert from a Microsoft service that really is from a Microsoft service.
That shift matters, because most staff training still teaches people to look for something that seems off. Increasingly there is nothing off to spot, which moves the answer from spotting to verifying.
Ian RobertsonFounder, Robertson Technology Group Fake CAPTCHA scams are evolving
The newest version asks the user to paste a command into their own computer, which sidesteps most of the protections sitting between them and a malicious download. It works on phones, where the warning signs are hardest to see.
Worth knowing: no legitimate verification ever asks you to press a key combination and paste something. Not one, ever.
Read the full postCould an AI voice assistant make sense for your business?
If your team answers the same handful of questions all day, some of those calls genuinely do not need a person. The useful question is which ones, and the answer is narrower than the marketing suggests.
Read the full postWhy trusting cybercriminals is never part of a strategy
Paying a ransom is a decision made under real pressure, with very little time to think clearly. That pressure is the product. Worth deciding where you stand on this before you ever have to.
Read the full postCopilot Wave 3, and what actually changed
Earlier versions helped people write and summarise. This one starts handling parts of a process on its own, which is a different thing to supervise and a different thing to budget for.
Read the full postOne thing worth doing this month
- Spend five minutes of your next staff meeting on the fake verification pattern. Show people what it looks like rather than emailing a policy nobody reads.
- While you are there, say out loud that nobody is ever in trouble for reporting a mistake. That single sentence does more than any training module.
That is everything for this month. If any of it raised a question about your own setup, just reply. A real person reads these.
IanGet it by email
One email a month. No more than that, ever.
The same four or five things, written for people who run businesses rather than for people who run servers. Unsubscribe in one click, and we will not sell or share your address with anyone.
Protected by reCAPTCHA.