Reviewed monthly
Security Briefing for Small Businesses
Current cyber threats affecting law firms, accounting firms, construction companies, real estate, and growing businesses. Plain-English summaries with steps you can take now.
By the Tecnico Desk team
Updated
The Tecnico Desk team researches and reviews every piece, working from vendor and regulator advisories and our own client work. AI helps with drafting, grammar, and spelling. How we use AI
This page tracks the cyber threats most relevant to small businesses with 10 to 75 employees. It is reviewed monthly, and sooner when a major advisory lands, drawing on CISA and vendor advisories alongside the patterns Tecnico Desk sees across the businesses we work with.
Each entry is written in plain English with specific steps your team can take. If something here applies to your business and you are not sure where you stand, a Security Fit Call is the fastest way to get a clear answer.
Active threats
Advisory items below are drawn from the CISA Known Exploited Vulnerabilities catalog and vendor advisories. Everything here is confirmed as exploited in the wild, not theoretical.
Windows zero-day under active attack (CVE-2026-68820)
Microsoft's August 2026 update fixes a flaw in the Windows driver that handles network connections (AFD.sys for WinSock). An attacker who already has a foothold on a computer, even with a low-privilege account, can use it to take full control of that machine. Check Point, which reported the flaw, observed attacks using it starting in early June and attributes them to a North Korean state group. CISA added it to the Known Exploited Vulnerabilities catalog on August 11, 2026.
Industries affected: Every business running Windows
What to do:
- Install the August 2026 Windows updates now, on servers and workstations alike.
- Confirm the updates actually applied. A device that has not rebooted has not finished patching, and any machine that was powered off for a stretch will still be exposed.
- Remember this is an escalation flaw, not the way in. It matters because it turns a single phished login into full control of the machine, which is why endpoint detection and prompt patching work together.
Cisco firewall flaw being used to knock devices offline (CVE-2026-20349)
A flaw in Cisco Secure Firewall ASA and Firewall Threat Defense lets an attacker on the internet crash the device by sending it a crafted web request, with no password and no user action needed. Cisco published the advisory on August 11, 2026 and confirmed it is being exploited. There is no workaround, only a patch. If it is used against you, your firewall and your staff's remote access go down together.
Industries affected: Any business using a Cisco ASA or Firewall Threat Defense appliance, particularly for remote access VPN
What to do:
- Apply Cisco's patch. There is no configuration change that mitigates this one.
- If you are not sure what firewall you have or who patches it, that uncertainty is the finding. Get it answered this week.
- Confirm someone owns firmware updates for network equipment. This is the layer small businesses most often leave unpatched for years.
AI-generated payment redirect emails targeting accounting and construction
Attackers are using AI to write convincing payment-change requests that impersonate vendors, subcontractors, and clients. The emails are grammatically clean, reference real invoice numbers or project names scraped from public records, and come from lookalike domains. Construction companies and accounting firms handling large wire transfers are the primary targets. The FBI's 2025 Internet Crime Report put business email compromise losses at $3 billion, inside a record $20.9 billion in total reported losses.
Industries affected: Construction, accounting, real estate, professional services
What to do:
- Verify every payment-change request by calling a known number, not the number in the email.
- Set a policy that no bank details are updated over email alone.
- Enable DMARC on your domain so receivers can reject mail sent as your domain that fails authentication.
Microsoft 365 token theft bypassing MFA
Adversary-in-the-middle phishing kits intercept the authentication session after a user enters their password and MFA code. The attacker captures the session token and uses it to access the mailbox without triggering another MFA prompt. This technique bypasses standard MFA and has been used against law firms and financial services companies.
Industries affected: Law firms, financial services, all Microsoft 365 users
What to do:
- Enable Conditional Access policies that restrict sign-ins to managed devices or trusted locations (requires Microsoft 365 Business Premium or Entra ID P1).
- Deploy phishing-resistant MFA (passkeys or FIDO2 keys) for administrator and high-value accounts.
- Monitor sign-in logs for logins from unusual locations or impossible-travel patterns.
- Review your Microsoft 365 security settings if you have not done so recently.
Ransomware groups targeting law firms for client-data extortion
Ransomware operators increasingly target law firms specifically because the data they hold is privileged and time-sensitive. The threat is not just encryption but publication: attackers threaten to release client files unless paid. Small firms are disproportionately vulnerable because they hold high-value data but typically lack dedicated security staff.
Industries affected: Law firms, accounting firms, financial services
What to do:
- Maintain tested, offsite backups that are isolated from your main network. Confirm you can actually restore from them.
- Restrict administrative access: no daily user account should have admin privileges.
- Enable endpoint detection and response on every device, not just antivirus.
- Review your cyber insurance readiness to make sure your coverage and controls are aligned.
Overshared SharePoint and Google Drive links leaking sensitive files
Many small businesses have SharePoint sites or Google Shared Drives with "anyone with the link" permissions set months or years ago. These links are sometimes indexed by search engines or found through leaked URLs. We routinely find client contracts, financial statements, and employee records exposed this way during security reviews.
Industries affected: All industries, especially firms that share files with external clients
What to do:
- Audit external sharing settings in SharePoint and OneDrive or Google Drive.
- Disable anonymous sharing links by default. Require sign-in for external access.
- Review existing shared links and revoke any that are no longer needed.
Former employee accounts used to access business systems
When an employee leaves and their accounts remain active, the risk is not hypothetical. We see it in nearly every security review: former staff with active Microsoft 365 mailboxes, VPN access, or cloud app logins. In some cases, departing employees have forwarded company email to personal accounts for weeks after leaving.
Industries affected: All industries, remote and hybrid businesses especially
What to do:
- Disable accounts same-day on departure. Do not wait for IT to "get around to it."
- Revoke active sessions and app passwords, not just the login.
- Check for mail forwarding rules set before departure.
- See our employee offboarding security guide for a full checklist.
Industry watch
Law firms
Bar associations in multiple states are tightening expectations around client data protection. Firms should be prepared to demonstrate specific controls including MFA, email encryption for sensitive communications, and documented access policies. A security review now is easier than responding to a bar inquiry later.
Accounting and CPA firms
The FTC Safeguards Rule requires tax preparers and financial service providers to maintain a written security program. Enforcement is active. If your firm has not documented its security controls and designated a qualified individual to oversee them, this is a compliance gap, not just a security gap. See our IT support for accounting firms page for context.
Construction and trades
Wire fraud and fake invoice scams remain the top threat. The Denver metro area is an active construction market, and the volume of electronic payments between GCs, subs, and suppliers creates daily opportunities for attackers. Payment verification procedures are the single most impactful control a construction company can put in place.
Real estate
Wire fraud at closing is still the most damaging attack in real estate. Attackers monitor email threads between agents, title companies, and buyers, then send convincing wire instructions from a spoofed or compromised account at the exact right moment. DMARC, verified wire procedures, and MFA on every email account are non-negotiable.
Remote and distributed businesses
Without a central office network, identity is the perimeter. Every access decision depends on who is logging in and from what device. Businesses with remote teams need stronger identity controls, managed devices or at minimum device compliance policies, and clear offboarding procedures that account for personal devices and home networks.
One thing to check now
Confirm the August updates actually installed. Pick five computers at random, including any that were off for a stretch this summer, and check that the August 2026 Windows updates are applied and the machine has rebooted since. Patching that is reported as deployed but never finished is one of the most common gaps we find, and this month it is the difference between a contained incident and a compromised machine.
Frequently asked questions
How often is this security briefing updated?
This page is reviewed monthly, and updated sooner when a major advisory affects small businesses. The date at the top of the page reflects the last update. It focuses on law firms, accounting firms, construction companies, real estate, and professional services in the Denver metro area and nationwide.
What should I do if a threat here applies to my business?
Each threat entry includes specific steps you can take. If you are unsure whether your business is exposed, book a Security Fit Call for a quick assessment of your environment.
Are these threats specific to Denver businesses?
Most cyber threats are not location-specific, but some targeting patterns like wire fraud in real estate and construction are more common in active markets like Denver. This briefing covers threats relevant to small businesses nationwide, with notes on local relevance where applicable.
Can Tecnico Desk fix these issues for my business?
Yes. Every threat listed here maps directly to controls Tecnico Desk implements for clients: MFA hardening, email security, backup verification, sharing audits, offboarding procedures, and endpoint protection. A Tecnico Ready security review identifies which gaps apply to your specific environment.
Not sure if these threats apply to you?
Book a Security Fit Call. We will tell you exactly where your business stands and what to fix first.