13 Jan

Tech & Cybersecurity Trends to Watch in 2026

What Actually Matters for Your Business…

Look, every January the internet explodes with tech predictions that sound like they were written by someone who’s never run a business. AI everything. Quantum computing. Buzzwords on buzzwords.

Here’s what we’ve learned: most “trends” don’t matter to you until they actually affect your operations or put your business at risk.

So instead of the usual hype, here’s what’s actually happening in 2026 that you need to pay attention to—and what to do about it.

1. AI Is Standard Business Infrastructure Now

The Reality:

AI tools are becoming as standard as email. Microsoft Copilot is baked into most Microsoft 365 plans. Your team is already using ChatGPT, Claude, and similar tools to draft emails and research topics, often without realizing they might be leaking sensitive data.

What You Need to Do:

Create an AI usage policy immediately
Get business versions that don’t train on your data (Copilot for Business, ChatGPT Enterprise)
Train your team on safe AI usage

Real Talk:

AI won’t replace your team, but employees who know how to use AI will replace those who don’t.

2. Ransomware Got Smarter and Nastier

The Reality:

Ransomware groups now use AI to write convincing phishing emails, they’re targeting smaller businesses (easier targets), and they’re not just encrypting your files—they’re stealing them first and threatening to publish everything if you don’t pay.

Insurance companies are getting picky too. No multi-factor authentication? No backup testing? Good luck getting coverage.

What You Need to Do:

Multi-factor authentication on EVERYTHING
Test your backups (actually do a restore, don’t just assume they work)
Get email filtering that catches threats before they reach inboxes
Have an incident response plan before you need it

Real Talk:

Average ransomware payment is $200K+ for small businesses, with 21 days of downtime. Can you survive three weeks offline?

3. Cloud Sprawl is Killing Your Budget

The Reality:

Everyone’s in the cloud, but most businesses have no idea what they’re paying for. Shadow IT everywhere—employees buying subscriptions, departments using different tools, nobody tracking anything.

Your cloud bill is probably 30-40% higher than it needs to be. Plus, every SaaS tool is another potential security hole.

What You Need to Do:

Audit subscriptions quarterly (pull those credit card statements)
Consolidate tools where possible
Implement single sign-on (SSO) for centralized access control
Set up proper permissions on shared drives

Real Talk:

We found $47,000 in annual waste for one client last month. That’s nearly $4K a month just… gone.

4. Your Employees Will Make Mistakes, Plan for It

The Reality:

Security training is important, but your employees are tired, busy, and checking email at 11 PM on their phones. They’ll make mistakes. The real problem is when they’re too embarrassed to report it immediately.

What You Need to Do:

Create a no-blame reporting culture
Implement security that works in the background (EDR tools)
Make security convenient (password managers, SSO, easy MFA)
Regular short training (5 minutes monthly, not annual 2-hour sessions)

Real Talk:

Your security problem isn’t the employee who clicked something, it’s that one click gave access to your entire network. That’s an architecture problem, not a people problem.

5. Zero Trust Isn't Just for Big Companies

The Reality:

“Zero Trust” is a fancy way of saying “stop assuming everyone inside your network is safe.” Your employees work from home, coffee shops, airports, your network perimeter doesn’t exist anymore.

What You Need to Do:

Start with MFA everywhere (yes, again)
Implement least-privilege access (nobody needs access to everything)
Look into zero-trust network access (ZTNA) tools instead of old VPNs
Monitor everything (3 AM access from Bulgaria should raise flags)

Real Talk:

Zero Trust sounds like overkill until a stolen password gives someone access to your entire file server.

6. Compliance Has Teeth Now

The Reality:

GDPR, CCPA, HIPAA, CMMC, regulators aren’t sending warning letters anymore. They’re hitting businesses with real penalties. “I didn’t know” isn’t a defense.

Your clients are asking more questions too. RFPs include security questionnaires. Partners want proof of your cybersecurity measures.

What You Need to Do:

Understand what regulations apply to you
Document everything (policies, procedures, evidence)
Regular security audits (don’t wait for deadlines or breaches)
Consider cyber insurance (but they’ll require security measures first)

Real Talk:

Compliance is a pain, but it’s a competitive advantage when you can confidently answer security questionnaires while competitors fumble.

7. You Can't Build an In-House Security Team (So Stop Trying)

The Reality:

There are 3.5 million unfilled cybersecurity jobs globally. A junior security analyst costs $80K+. A senior one? $150K+. You can’t afford that, and even if you could, you can’t find them.

What You Need to Do:

Stop trying to do everything in-house
Find a managed service partner who actually cares (not just ticket-takers)
Get 24/7 monitoring (attacks don’t happen 9-5)
Invest in the relationship (your IT partner should feel like part of your team)

Real Talk:

One full-time IT person costs $60-80K plus benefits. A managed service gives you a whole team with specialized skills for roughly the same cost.

8. Remote Work Security Can't Be an Afterthought

The Reality:

Your security perimeter is now every employee’s home network, phone, laptop, and coffee shop WiFi. The “protect the office network and you’re fine” approach is dead.

What You Need to Do:

Secure all endpoints (every laptop, phone, tablet)
Company-managed devices only (BYOD is asking for trouble)
Cloud-based security that works anywhere
Modern access solutions (VPN or better alternatives like ZTNA)

Real Talk:

Secure the users, not the location.

9. Supply Chain Attacks Are Everywhere

The Reality:

Why break into your network when attackers can breach your software vendor and push malware through their update system? Every vendor and tool is a potential entry point.

What You Need to Do:

Vet vendors before signing up (ask about their security practices)
Limit vendor access (sandbox it)
Monitor third-party tools
Have a vendor incident response plan

Real Talk:

You can have perfect security and still get breached because a vendor three steps removed got compromised.

10. Passwords Are Finally Dying

The Reality:

Passwordless authentication is getting real. Apple, Google, and Microsoft are pushing passkeys hard. More services offer FaceID, fingerprint, or security key login instead of passwords.

What You Need to Do:

Enable passkeys where available
Still use password managers (we’re not fully passwordless yet)
MFA everywhere
Plan migration as your tools add passkey support

Real Talk:

Passwordless is both more secure AND more convenient. Rare win-win.

Technology should make your business run better, not keep you up at night. You don’t need to be on the bleeding edge of everything, but you need the basics covered: strong authentication, good backups, proper monitoring, trained employees, and a partner who has your back.

These aren’t abstract future problems, they’re affecting businesses right now. The question isn’t whether these trends will impact you. It’s whether you’ll be ready when they do.

Want help making sense of this? We do free security assessments, no sales pitch, no fear mongering. Just an honest look at where you stand and recommendations you can actually act on.

Schedule your free security assessment.

Talk With An Expert

01 Sep

The Agency & The Venue: A Business Email Compromise (BEC) Attack

by Mathew Mendel

in Articles, Security

Comments

Business Email Compromise – When the criminal’s reading your email.

We’re all connected – the closer a hacker gets to your vendor, your client, your partner… the closer they are to you. Here’s the story of an advertising agency who thought they were communicating with their event venue.

Inc. estimates 60% of companies go out of business within six months of a cyber attack.

Haven’t we had enough attacks, hacks and breaches? The best offense is a strong defense – it’s time to start defending ourselves!

Drop your name and email to learn more, or tag our calendar to setup a conversation.

22 Apr

Quick, What’s a Vulnerability Assessment?

by Mathew Mendel

in Security, Services

Comments

Can today’s business leader explain what a vulnerability assessment actually is?

Like trying to explain what water tastes like, or defining the word “the”, we’ve found that while today’s business leader is quite familiar with the term “vulnerability assessment” few can explain what a vulnerability assessment actually is.

Even more, ask three IT professionals what a vulnerability assessment is and you’re likely to get three different answers.

So what is a vulnerability assessment? How often should you have one? How much should you expect to pay? And what’s the difference between a vulnerability assessment and a penetration test? .

Defining a vulnerability assessment as “the process of defining, identifying, classifying, and prioritizing vulnerabilities in computer systems,applications, and network infrastructures”, our friends at TechTarget have published an excellent article defining the process and detailing some of the finer points. Below is a summary of TechTarget’s publication, and a few of their highlighted best practices. (For a deeper dive into the process, check out www.techtarget.com/searchsecurity/definition/vulnerability-assessment-vulnerability-analysis) ‍

As explained by Linda-Rosencrance of TechTarget, a vulnerability assessment can provide an organization with the necessary knowledge to understand and react to threats within its environment. Organizations of any size, or even individuals who face an increased risk of cyber attacks, can benefit from some form of vulnerability assessment, but large enterprises and high-target organizations (eg. insurance agencies, financial institutions, accounting firms, medical offices, law firms) that are subject to attacks will benefit most from a vulnerability analysis as they provide an organization details on any security weaknesses in its environment and direction on how to assess the risks associated with those weaknesses.

The process offers an organization a better understanding of its technology assets, security flaws and overall risk, thereby reducing the likelihood that a cybercriminal will breach its systems and catch the business off-guard.‍

Types of vulnerability assessments

· Network-based scans: Used to identify possible network security attacks. This type of scan can also detect vulnerable systems on wired or wireless networks.

· Host-based scans: Used to locate and identify vulnerabilities in servers, workstations or other network hosts.This type of scan usually examines ports and services that may also be visible to network-based scans. However, it offers greater visibility into the configuration settings and patch history of scanned systems, even legacy systems.

· Wireless network scans: Focus on points of attack within the organization’s wireless network infrastructure. In addition to identifying rogue access points, a wireless network scan can also validate that a company’s network is securely configured.

· Application scans: Test websites to detect known software vulnerabilities and incorrect configurations in network or web applications.

· Database scans: Identify weak points in a database to prevent malicious attacks, such as SQL injection attacks.

Vulnerability assessment vs. pen test

A vulnerability assessment often includes a penetration testing component to identify vulnerabilities in an organization’s personnel, procedures or processes. These vulnerabilities might not normally be detectable with network or system scans. The process is sometimes referred to as vulnerability assessment/penetration testing, or VAPT.

However, penetration testing is not sufficient as a complete vulnerability assessment and is, in fact, a separate process.

A vulnerability assessment aims to uncover vulnerabilities in a network and recommend the appropriate mitigation or remediation to reduce or remove the risks. It uses automated network security scanning tools, and lists the results in an assessment report. However, it does so without evaluating specific attack goals or scenarios. Organizations should employ vulnerability testing on a regular basis to ensure the security of their networks, particularly when changes are made. For example, testing should be done when services are added, new equipment is installed or ports are opened.

Penetration testing, in contrast, involves identifying vulnerabilities and attempting to exploit them in order to attack. Although sometimes carried out in concert with vulnerability assessments, the primary aim of penetration testing is to check whether a vulnerability really exists and infiltrate the organization. In addition, penetration testing tries to prove that exploiting a vulnerability can damage the application or network.

Finally, while a vulnerability assessment is usually automated to cover a wide variety of unpatched vulnerabilities, penetration testing generally combines automated and manual techniques to help testers delve further into the vulnerabilities and exploit them to gain access to the network in a controlled environment.

For more information or to discuss how a vulnerability assessment can help your organization just complete the form below or set a time to connect.

Portions of this article were written by Linda-Rosencrance and published by TechTarget at www.TechTarget.com/searchsecurity/definition/vulnerability-assessment-vulnerability-analysis

05 Apr

The Case for Zero Trust Cybersecurity

by Mathew Mendel

in Articles, Operations, Security, Services

Comments

As the business community faces down cyber threats, one medical office is defending itself with a Zero Trust approach to cybersecurity

Physicians have always been at the front of the line when it came to technology integration. Among the first to realize the benefits wearing a pager, having a cell phone, using a tablet, and essentially digitizing their business, doctors and researchers are typical early adopters of mobile, Cloud and IOT systems.

As attacks on the healthcare industry make weekly news, personal information (PII) floods the black market, and steep fines take their toll,doctors and practice administrators wonder what they can do differently.

A holistic strategy, a Zero Trust approach to cybersecurity means that you:

1) Verify Explicitly
2) Use Least Privilege
3) Assume Breach
‍
Want to learn more? Complete the form and download the business case.

30 Mar

You’re About to Get Hit. You Ready?

by Mathew Mendel

in Operations, Security, Services

Comments

As cyberattacks on midsize firms prove inevitable, are you ready to be hit?

A strong defensive posture minimizes exposure, limits collateral damage and protects client privacy. ‍

We’ve been providing IT consulting and technology services to the mid-size business community since 1999, and from basic firewalls to advanced breach detection systems we absolutely guarantee there’s no shortage of security products designed to protect the enterprise.

But third party/supply chain attacks have changed this game. Drastically. And, from the most basic user training videos, to a 24×7 monitored security and information management (SEIM) system, there’s not one thing a business can do to protect data when its business management system, ERP or CRM is breached. Bottom line – every business on the planet relies on third-party software and there’s simply no safe place to hide. Boo!

Since shutting down shop isn’t an option, we must, as always, take up this threat and face it head on!

As we wrote in an post about Zero Trust Cybersecurity, you can only worry about what’s within your control. Since fully defending against this attack isn’t possible, we can only protect our organizations and prepare to be attacked.

1. Deploy a multi-layered detection and response approach. Multisyllable marketing jargon aside – as quickly as possible, you need to know you’ve been breached, and you need a post-attack response plan (or plans). “Honeytokens” or virtual trip wires setup to alert organizations of suspicious activity in their network are a great tool. If a being breached is bad, not learning about it till days or weeks after it happens is worse and not knowing what to do next can be catastrophic. www.upguard.com/blog/how-to-prevent-supply-chain-attacks

2. Include threat hunting as regularly scheduled IT maintenance. As described by our partners at SentinolneOne, threat hunting is quite a different activity from incident response (IR). While IR methodologies aim to determine what happened after a data breach, a threat hunting team searches for attacks that have slipped through your defensive layers to help you find adversaries hiding in your network before they can execute an attack or fulfill their goals.

3. Work with a SIEM solution that offers automated remediation actions. A security information and event management (or SIEM) is a cybersecurity solution that collects and converges data from different parts of your IT environment with the intent of monitoring your firm’s security levels. Providing advanced visibility and insight into your users, endpoints, traffic, activity, and more, a SIEM enables you to maintain oversight into your network and beyond the perimeter as your company scales.

4. Log capture and file retention for critical infrastructure. As detailed in this whitepaper from the National Institute for Standards & Technology (NIST) nvlpubs.nist, log management is essential to ensuring that computer security records are stored in sufficient detail for an appropriate period of time. Routine log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems.

5. Encryption for all data. In cryptography, encryption is the process of encoding information or sensitive data so only authorized parties can access it. While encryption can’t prevent criminal activity or third-party attacks, it does deny intelligible content to the interceptor. For more on encryption, we recommend this article published by UpGuard www.upguard.com/blog/encryption.

6. Use two-factor/multi-factor authentication. With two-factor authentication enabled, criminals who do gain access to user login credentials aren’t automatically granted entry. A key element to a Zero-Trust Security framework, multi-factor authentication requires users validate their identity to provide that extra layer of security.

Above all, at OWG we believe cybersecurity will always come down to your corporate culture and your posture – on your toes, knees bent, arms ready. Stay sharp, be prepared and have your plan in place and you’ll have an advantage and typically able to weather the storm. The complacent or unprepared will get swallowed.

For more information, or to set a time to speak, drop your name and email below and we’ll reach out.

#StaySafeOnline‍

18 Mar

What is Zero Trust Cybersecurity?

by Mathew Mendel

in Security

Comments

Confusion about Zero Trust is making it harder to implement

As we detailed in our business case exploring the Zero Trust, at its core, ZT is a concept and shift in how organizations approach the idea of security and data privacy.

It’s not one product or piece of software, rather an approach that assumes breach and secures your organization by requiring users prove they are who they say they are and be granted gated access accordingly.

As explained in a recent article from WIRED, “What is Zero Trust” the approach eliminates the old moat & castle networking model and instead of trusting particular devices and assuming what’s inside your walls are safe, a Zero Trust methodology uses verification, network segmentation and least privilege to protect the enterprise.

Eliminate the moat & castle model of cybersecurity

Under the old model, all the computers, servers, and other devices physically in an office building were on the same network and trusted each other. Your work computer could connect to the printer on your floor or find team documents on a shared server. Tools like firewalls and antivirus were set up to view anything outside the organization as bad;everything inside the network didn’t merit much scrutiny.

However, the explosion of mobile devices, cloud services,and remote/hybrid work have radically challenged those assumptions. Organizations can’t physically control every device its employees use anymore. And even if they could, once an attacker slipped by perimeter defenses, the network would instantly grant them a lot of trust and freedom. “Outside bad, inside good.”‍

“Zero Trust is a concept, not an action.”

Ken Westin, Security Researcher

Instead of trusting particular devices or connections from certain places, Zero Trust demands that people prove they are who they claim and should therefore be granted access. Typically, that means logging into a corporate account with biometrics or a hardware security key in addition to usernames and passwords to make it harder for attackers to impersonate users. And even once someone gets through, it’s on a need-to-know or need-to-access basis. If you don’t invoice contractors as part of your job, your corporate account shouldn’t tie into the billing platform.

Zero Trust isn’t a single piece of software you can install or a box you can check, but a philosophy, a set of concepts, a mantra,a mindset.

You still must implement things like device and software inventory, network segmentation, access controls.

Confusion about the real meaning and purpose of Zero Trust makes it harder for people to implement the ideas in practice. Proponents are largely in agreement about the overall goals and purpose behind the phrase, but busy executives or IT admins with other things to worry about can easily be led astray and end up implementing security protections that simply reinforce old approaches rather than ushering in something new.

Here at OWG, we work with our partner clients and help them engineer a true Zero Trust methodology throughout their IT ecosystem. If you have questions or would like to see if we can help your organization better protect its most critical data, email partnerwithus@overwatchgrp.com or click here to set a time to speak.i

08 Mar

Feds: “Beef Up Cybersecurity and Adopt a ‘Zero Trust’ Framework”

by Mathew Mendel

in Articles

Comments

As organizations across the country begin to adopt the Zero Trust approach, federal agencies will do the same.

As part of a new cybersecurity strategy released Wednesday, the administration outlines its vision for moving government agencies towards a “zero trust” architecture — a cybersecurity model where users and devices are only given permissions to access network resources necessary for the task at hand and are authenticated on a case-by-case basis.

The key document was published as a memorandum from the Office of Management and Budget (OMB), the administration’s policy arm, and addressed to the heads of all executive departments and agencies.
According to the memorandum, shifting towards a zero trust architecture will require the implementation of stronger enterprise identity and access controls, including more widespread use of multi-factor authentication — specifically hardware-based authentication tokens like access cards, rather than push notifications or SMS. Agencies were also instructed to aim for a complete inventory of every device authorized and operated for official business, to be monitored according to specifications set by the Cybersecurity and Infrastructure Security Agency (CISA).

“In the face of increasingly sophisticated cyber threats, the Administration is taking decisive action to bolster the Federal Government’s cyber defenses,” said acting OMB director Shalanda Young in a statement. “This zero trust strategy is about ensuring the Federal Government leads by example, and it marks another key milestone in our efforts to repel attacks from those who would do the United States harm.”
The White House’s announcement cited the Log4j security vulnerability as “the latest evidence that adversaries will continue to find new opportunities to get their foot in the door.” The vulnerability, one of the most serious and widespread cybersecurity threats for years, first began to be exploited in December 2021. At the time, government agencies were instructed by CISA to immediately patch vulnerable assets or take other mitigation measures. The FTC also subsequently warned companies in the private sector to remediate the vulnerability to avoid potential legal action for putting consumers at risk.
“As our adversaries continue to pursue innovative ways to breach our infrastructure, we must continue to fundamentally transform our approach to federal cybersecurity,” said CISA director Jen Easterly. “Zero trust is a key element of this effort to modernize and strengthen our defenses. CISA will continue to provide technical support and operational expertise to agencies as we strive to achieve a shared baseline of maturity.”
An initial draft of the strategy was released in September 2021 for public comment and since then has been shaped by input from the cybersecurity industry as well as other fields of the public and private sector.
With the final strategy now released, government agencies have been issued 30 days to designate a strategy implementation lead within their organization and 60 days to submit an implementation plan to the OMB.

Drop your name and email to learn more, or tag my calendar to setup a conversation.

Portions of this article were originally published by The Verge and is available at https://www.theverge.com/2022/1/26/22902630/white-house-instructs-agencies-cybersecurity-strategy-memo-cisa

Client Area

cybersecurity Tag

What Actually Matters for Your Business…

1. AI Is Standard Business Infrastructure Now

The Reality:

What You Need to Do:

Real Talk:

2. Ransomware Got Smarter and Nastier

The Reality:

What You Need to Do:

Real Talk:

3. Cloud Sprawl is Killing Your Budget

The Reality:

What You Need to Do:

Real Talk:

4. Your Employees Will Make Mistakes, Plan for It

The Reality:

What You Need to Do:

Real Talk:

5. Zero Trust Isn't Just for Big Companies

The Reality:

What You Need to Do:

Real Talk:

6. Compliance Has Teeth Now

The Reality:

What You Need to Do:

Real Talk:

7. You Can't Build an In-House Security Team (So Stop Trying)

The Reality:

What You Need to Do:

Real Talk:

8. Remote Work Security Can't Be an Afterthought

The Reality:

What You Need to Do:

Real Talk:

9. Supply Chain Attacks Are Everywhere

The Reality:

What You Need to Do:

Real Talk:

10. Passwords Are Finally Dying

The Reality:

What You Need to Do:

Real Talk:

Business Email Compromise – When the criminal’s reading your email.

We’re all connected – the closer a hacker gets to your vendor, your client, your partner… the closer they are to you. Here’s the story of an advertising agency who thought they were communicating with their event venue.

Inc. estimates 60% of companies go out of business within six months of a cyber attack.

Haven’t we had enough attacks, hacks and breaches? The best offense is a strong defense – it’s time to start defending ourselves!

Drop your name and email to learn more, or tag our calendar to setup a conversation.

Can today’s business leader explain what a vulnerability assessment actually is?

Types of vulnerability assessments

Vulnerability assessment vs. pen test

As the business community faces down cyber threats, one medical office is defending itself with a Zero Trust approach to cybersecurity

As attacks on the healthcare industry make weekly news, personal information (PII) floods the black market, and steep fines take their toll,doctors and practice administrators wonder what they can do differently.

A holistic strategy, a Zero Trust approach to cybersecurity means that you:

1) Verify Explicitly 2) Use Least Privilege 3) Assume Breach‍Want to learn more? Complete the form and download the business case.

As cyberattacks on midsize firms prove inevitable, are you ready to be hit?

A strong defensive posture minimizes exposure, limits collateral damage and protects client privacy. ‍

Confusion about Zero Trust is making it harder to implement

As organizations across the country begin to adopt the Zero Trust approach, federal agencies will do the same.

Drop your name and email to learn more, or tag my calendar to setup a conversation.

Portions of this article were originally published by The Verge and is available at https://www.theverge.com/2022/1/26/22902630/white-house-instructs-agencies-cybersecurity-strategy-memo-cisa

CONTACT

SIGN UP FOR OUR NEWSLETTER!

1) Verify Explicitly
2) Use Least Privilege
3) Assume Breach
‍
Want to learn more? Complete the form and download the business case.