Along the way: why attackers mostly log in instead of breaking in, why the ransom usually isn't the biggest bill, and what paying actually buys you.

In this episode

• The four stages of an attack. Get in, look around, take, lock, and why 79% of attacks in Sophos's 2026 survey started with someone's login.
• The forgotten door. Among victims whose attack began with a stolen password, 97% had MFA turned on somewhere. Somewhere is the problem.
• What it really costs. Median recovery cost was $375,000 before any ransom, and the average recovery took three weeks.
• The HIPAA angle. Why HHS presumes ransomware on patient data is a reportable breach, and what that means for medical and dental practices.
• Should you pay? Why the FBI says no, and what law enforcement found when it took down LockBit.
• What actually stops it. MFA on every login, someone watching around the clock, backups that can't be deleted, and a plan on paper.

Your one thing this week: list every way someone can log in to your business from the outside, and find out which ones don't have MFA.

Chapters

• 0:00 Intro
• 0:10 A Monday morning at a dental practice
• 1:06 Ransomware in plain English
• 2:00 Too small to be a target?
• 2:37 How an attack unfolds
• 5:30 What it really costs
• 7:14 Should you pay?
• 8:12 What actually stops it
• 11:27 The same story, done right
• 12:18 Your one thing this week
• 12:49 How to reach Jason

Mentioned in this episode

• Episode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy
• Episode 4: Don't Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)

Sources

• Sophos, The State of Ransomware 2026
• Coveware by Veeam, Q2 2026 Quarterly Report
• Verizon, 2026 Data Breach Investigations Report
• FBI, Ransomware
• HHS, Fact Sheet: Ransomware and HIPAA
• FBI Internet Crime Complaint Center (report an attack)

Want a second set of eyes on your login list?

Email Jason directly at jason@harmony-msp.com. Send him the list, and he'll help you find the doors you forgot about.

Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

First, he retires a statistic you've probably seen: that 60% of small businesses close within six months of a cyberattack. Reporters found no study behind it, and the organization it's usually credited to has asked people to stop using it. What does hold up: the FBI logged more than one million internet crime complaints in 2025, with nearly $21 billion in reported losses, and Florida ranked third in the country for both.

The countdown

• #10 Lock down your Wi-Fi and retire the old router. Why the FBI says end-of-life routers should be replaced.
• #9 Protect the devices themselves. Screen locks, encryption, remote wipe, and why EDR watches for what antivirus misses.
• #8 Give people only the access they need. Separate admin accounts, same-day offboarding, and the vendors who can still log in.
• #7 Use a password manager. A unique password for every account, and why to take the passkey when a site offers one.
• #6 Write a one-page incident plan, and print it. Who to call first, and how the FBI froze $679 million in 2025 for victims who reported fast.
• #5 Train your team for the scams they'll actually get. In Verizon's phishing tests, text and phone scams drew a 40% higher click rate than email.
• #4 Keep everything updated, and retire what can't be. Software flaws are now the top way attackers get in, plus what Microsoft's Windows 10 extension does and doesn't change.
• #3 Back up like you'll actually need it. Offline, immutable and tested, because a backup you've never restored from is just a hope.
• #2 Verify every payment change with a phone call. Business email compromise cost victims more than $3 billion in 2025, and voice cloning is now part of the playbook.
• #1 Turn on multi-factor authentication, starting with email. Why email comes first, which kinds of MFA are strongest, and what to cover next.

Chapters

• 0:00 Intro
• 0:10 The 60% statistic that isn't real
• 1:17 Don't Make It Easy for Them
• 2:01 #10 Wi-Fi and old routers
• 2:53 #9 Protecting the devices
• 3:43 #8 Access and offboarding
• 4:44 #7 Password managers and passkeys
• 5:39 #6 The one-page incident plan
• 6:47 #5 Training for texts and calls
• 8:04 #4 Updates and end-of-life tech
• 9:37 #3 Backups
• 10:37 #2 Verifying payment changes
• 12:08 #1 MFA, starting with email
• 13:24 Recap and where to start
• 14:16 How to reach Jason

Mentioned in this episode

• Episode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy
• Episode 2: Your Email Domain Is Being Spoofed (Here's How to Stop It)
• Episode 3: how to find and vet a managed service provider

Sources

• FBI Internet Crime Complaint Center, 2025 Internet Crime Report
• Verizon, 2026 Data Breach Investigations Report
• Verizon, 2026 DBIR and Breach Impact Study insights for SMBs
• National Cybersecurity Alliance, Cybersecurity Awareness Month 2026
• FBI, Operation Winter SHIELD
• FBI, Cyber Criminal Proxy Services Exploiting End of Life Routers
• Microsoft Research, How Effective Is Multifactor Authentication at Deterring Cyberattacks?
• Microsoft, Windows 10 Extended Security Updates
• Tom's Hardware on the Windows 10 extension
• Nextgov, How a Fake Cyber Statistic Raced Through Washington

Need help with your list?

If you couldn't check off more than a few, email Jason directly at jason@harmony-msp.com. Tell him which numbers you're stuck on, and he'll help you figure out where to start.

Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

Search for IT companies near you and every website makes the same four promises: proactive monitoring, fast response, security built in, and local support. Those words can't tell you which managed service provider is actually good. Evidence can.

Jason Russell founded Harmony MSP, the firm that sponsors this show, so he says up front that he has a stake in how you choose. Then he walks through the seven-step vetting process he'd want you to run on his own company. It starts with the one-page requirements list you write before any sales call and ends with the scorecard you use to pick a winner.

Along the way:

• Why Verizon's 2026 Data Breach Investigations Report found a third party involved in 48% of breaches, and why that number is easy to misread
• What federal cyber agencies told MSP customers to require
• The difference between response time and resolution time
• The contract terms that decide whether you can ever cleanly leave

Florida listeners get three local specifics: hurricane planning, the state's 10-day breach-notice clock for IT providers, and the cybersecurity safe harbor Florida still doesn't have.

In this episode

 00:00 Every IT company makes the same promises
 00:43 A disclosure, and a promise
 02:11 Step 1: Write down what you need before you call anyone
 03:41 Step 2: Build your shortlist on fit, not ad spend
 05:12 Step 3: Ask for documents, not demos
 08:08 Step 4: Check references like an investigator
 09:16 Step 5: Treat the sales process as a preview
 09:59 Step 6: Read the contract for the exit
 11:30 Step 7: Score your finalists on evidence
 12:25 For Florida listeners: hurricanes, breach notice, and a myth
 14:41 What vetting can't tell you
 15:32 The short version, and how to reach us

Key takeaways

• Write a one-page requirements list before any sales call: headcount and locations, critical software, regulated data, hours, onsite needs, and last year's cyber insurance application.
• Ask for documents, not demos: 
  • a sample MSA and SLA
  • a real monthly report
  • a written description of how they secure their own access
  • certificates of insurance
  • the date of their last full restore test
  • a written breach-notice commitment
• Response time means someone acknowledged your ticket. Resolution time means it's fixed. Check which one the SLA actually promises.
• Your domain, Microsoft 365 or Google Workspace tenant, firewall, and backups should be in your company's name, with your own people holding top-level access.
• Score finalists only on what they showed you, not what they told you.

Resources

• Full written guide, with the weighted scorecard: https://harmony-msp.com/it-companies-in-orlando-how-to-vet-an-msp/
• Episode 1 companion, on cyber insurance applications: https://harmony-msp.com/how-to-answer-cyber-insurance-renewal-questions-without-voiding-your-policy/

Sources referenced in this episode

• Verizon, 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/
• CISA, NSA, FBI, and international partners, Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A): https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a
• HHS Office for Civil Rights, Business Associates: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
• FTC Safeguards Rule, 16 CFR 314.4: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
• The Florida Bar, Ethics Opinion 12-3: https://www.floridabar.org/etopinions/etopinion-12-3/
• Florida Information Protection Act, s. 501.171, Florida Statutes: https://www.flsenate.gov/Laws/Statutes/2025/501.171
• Florida CS/CS/HB 473 (2024), vetoed: https://www.flsenate.gov/Session/Bill/2024/473
• Florida CS/SB 692 (2026), died in committee: https://www.flsenate.gov/Session/Bill/2026/692
• Florida Division of Corporations (Sunbiz) business search: https://dos.fl.gov/sunbiz/search/
• Davis Wright Tremaine, on state cybersecurity safe harbor laws: https://www.dwt.com/blogs/privacy--security-law-blog/2023/07/iowa-cybersecurity-breaches-safe-harbor

Want a second set of eyes?

If you have IT proposals on your desk and want someone to go through them with you, call (407) 720-6540 or email Jason directly at jason@harmony-msp.com.

About the host

Jason Russell is the founder and CEO of Harmony MSP, a managed IT and cybersecurity firm in Lake Mary, Florida. A former Navy cryptologic technician and NSA network security consultant, he's spent more than two decades translating security problems into decisions business owners can actually act on. He's the author of Secured: The Cybersecurity Survival Guide.

Sponsor

Ctrl+Alt+Protect is brought to you by Harmony MSP: managed IT, network security, and compliance for small businesses, law firms, medical and dental practices, and accounting firms across Central Florida. https://harmony-msp.com

Tags
managed service provider, MSP, how to choose an IT company, how to vet an MSP, managed IT services, IT support contract, service level agreement, SLA, third-party risk, vendor risk, cyber insurance, HIPAA business associate agreement, FTC Safeguards Rule, Florida Information Protection Act, hurricane preparedness, small business cybersecurity, Orlando IT support, Central Florida, Ctrl+Alt+Protect

In this episode, Jason Russell walks through why email was built this way, and the three DNS records that make spoofing much harder to pull off: SPF, the list of servers allowed to send for your domain; DKIM, the tamper-proof signature on every message; and DMARC, the rule that ties them together and tells receiving servers what to do when something fails.

Then the part most businesses miss. DMARC has three policy settings, and the most common mistake is stopping at the first one. A domain sitting at p=none gets you reports about being spoofed — not protection from it. CISA treats that setting as a temporary step toward reject, not a finish line.

The episode closes with what these records genuinely cannot stop: lookalike domains and display-name spoofing, both of which show up constantly in wire fraud aimed at law firms and title companies. Records handle the easy version of the attack. A verification habit handles the rest.

You'll finish this one knowing exactly what to ask your IT provider, and how to tell whether the answer you get is a real answer.

In this episode

• (0:00) Why someone can send mail in your name right now
• (1:40) The envelope analogy: why email never verified senders
• (3:30) SPF — the list of who's allowed to send
• (5:00) DKIM — the signature that proves nothing was altered
• (6:15) DMARC — the rule that ties it together
• (8:15) The p=none trap, and why it isn't protection
• (10:00) What these records don't stop: lookalike domains and display-name spoofing
• (12:00) Why this matters even if you barely send email
• (13:30) The three-step rollout, in order
• (15:00) What to do this week

Key takeaways

• Email doesn't verify senders on its own. Your domain is forgeable until you configure it otherwise.
• SPF lists authorized servers, DKIM signs messages, DMARC decides what happens on failure and reports who's using your domain.
• p=none is monitoring, not protection. Real protection starts at quarantine and lives at reject.
• Free checkers confirm records exist — not that they're configured correctly, which is where most problems hide.
• Neither DMARC nor anything else catches lookalike domains or display-name spoofing. Verify payment changes by phone, using a number you already have.

Resources

• Companion article: How to Stop Someone From Sending Email in Your Company's Name — https://harmony-msp.com/how-to-stop-someone-from-sending-email-in-your-companys-name/
• CISA Binding Operational Directive 18-01, Enhance Email and Web Security — https://www.cisa.gov/binding-operational-directive-18-01
• Google Email Sender Guidelines FAQ — https://support.google.com/mail/answer/14229414
• Microsoft, "Strengthening the Email Ecosystem: Outlook's New Requirements for High-Volume Senders" — https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730
• Law firm IT and security — https://harmony-msp.com/industries-we-serve/law-firm/
• Medical and dental practice IT and security — https://harmony-msp.com/industries-we-serve/medical-dental-practices/

Here's what most business owners don't realize: that application is a warranty document. Every box you check is a legal promise about how your business actually operates. If a forensic investigation after a claim finds your environment didn't match what you wrote down, the carrier can rescind the policy, which means your claim is denied and prior payouts can be clawed back. Some courts have held that the carrier doesn't even have to prove the misrepresentation caused the loss.

In this episode, Jason Russell walks through the three incidents that rewrote the modern cyber insurance application, what underwriters are really asking in each section, and how to answer accurately when you know you have a gap.

You'll learn:

• Why MOVEit, Change Healthcare, and the Arup deepfake fraud are behind nearly every new question on your form
• What "immutable" and "air-gapped" actually mean, and why "we back up Microsoft 365" no longer clears the bar
• The five places MFA has to be turned on to pass clean, and why SMS codes are now the weak answer
• The privileged access management question most owners have never seen before
• Callback verification for wire transfers, and what carriers now refuse to cover at all
• The difference between EDR and MDR, and how to answer when you don't have MDR yet
• Why rescission is a worse outcome than any premium increase
• A 30-day pre-renewal checklist you can work through before you sign

The short version: an honest application with a couple of gaps and a plan is a policy that will still be there when you need it. A perfect-looking application that doesn't match your network is an expensive piece of paper.

Ctrl+Alt+Protect is a show for those owners and the people who keep their offices running.

Host Jason Russell spent more than eight years in the U.S. Navy as a cryptologic technician, running shipboard networks and encrypted communications during tactical operations. He went on to work at the National Security Agency as a network security consultant, then spent four years in Iraq leading the Multi-National Division–Baghdad Tactical Biometrics Cell and a team of forty field support engineers. In 2011 he brought that work home to Central Florida and founded what is now Harmony MSP, where he works with small businesses, medical and dental practices, law firms, and accounting firms.

In this trailer, Jason lays out what the show covers and how: one topic per episode, explained plainly. Why the email from your bookkeeper might not be from your bookkeeper. What a cyber insurance application is actually asking you to certify. Which items on a vendor's proposal matter, and which you can pass on.