Newsletter Review Page

Welcome to the October 2026 edition of IT Insights & News — our monthly roundup of what is happening in IT and cybersecurity that matters to Central Florida businesses. If a colleague forwarded this to you, you can subscribe here.

This Month at a Glance

• Cybersecurity Awareness Month: what it actually means for your business
• Windows 10 End-of-Life: the clock is now under 12 months
• Network Segmentation: the most overlooked protection in small business IT
• Quick Tip: How to check whether your backups are actually working
• From the Team: What we are seeing in the field this month

Cybersecurity Awareness Month: Beyond the Posters

October is Cybersecurity Awareness Month — a designation that has existed since 2004 and that, if we are honest, has produced a lot of posters and not always a lot of change. We want to use this month to talk about what security awareness actually looks like when it works, versus what it looks like when it is just a compliance checkbox.

The checkbox version: send employees a phishing awareness email in October, maybe run a brief online training module, and call it done for the year. This approach satisfies an auditor who is looking for evidence of security training. It does not meaningfully change employee behavior.

The version that works looks different:

Simulated phishing campaigns run throughout the year, not just in October. The goal is not to catch employees — it is to give them low-stakes practice at recognizing and reporting suspicious messages. Employees who have clicked on a simulated phishing link and seen the immediate feedback are significantly more cautious with real phishing attempts. Running campaigns quarterly keeps the skill current.

Training is specific to the threats employees actually face. A generic "do not click suspicious links" module does not prepare employees for the AI-generated, contextually accurate phishing emails we described last month. Training should include real examples of current attack techniques — business email compromise, invoice fraud, fake IT support requests — not just theoretical scenarios.

Reporting is encouraged and frictionless. Employees who suspect a phishing attempt should have a clear, easy way to report it — and should feel confident that reporting is welcomed, not penalized. A culture where employees are afraid to admit they almost clicked something is a culture where real incidents go unreported.

Leadership participates visibly. Security culture starts at the top. When leadership treats security training as something that applies to everyone — including themselves — employees take it more seriously.

If your security awareness program has not been updated since before 2025, it is not addressing the current threat landscape. We can help you design a program that actually changes behavior. Call us at 352-432-4200.

Windows 10 End-of-Life: Under 12 Months and Counting

Microsoft will end support for Windows 10 on October 14, 2025. As of this newsletter, that is less than 12 months away. If your business has computers still running Windows 10, now is the time to act — not because the deadline is tomorrow, but because hardware assessments, procurement, imaging, and deployment take time, and businesses that start in Q1 2025 will be scrambling.

Here is where most businesses stand right now, based on what we are seeing across our client base:

Some computers can be upgraded to Windows 11 in place. If the hardware meets Windows 11 requirements — including TPM 2.0, which most computers manufactured after 2017 have — the upgrade is straightforward. The main work is testing application compatibility and planning the rollout so it does not disrupt operations.

Some computers need to be replaced. Older hardware that cannot run Windows 11 needs to be replaced before the deadline. If you have a significant number of machines in this category, procurement lead times and budget planning need to start now.

Extended Security Updates are a bridge, not a solution. Microsoft will offer paid Extended Security Updates (ESU) for Windows 10 after the end-of-life date. This buys time but does not eliminate the need to upgrade. ESU costs increase each year, and cyber insurers are beginning to ask about end-of-life operating systems in underwriting questionnaires.

The right first step is a complete inventory of your computers and their Windows versions. If you do not have that inventory, we can run one for you. From there, we can give you a clear picture of what the upgrade path looks like for your specific environment and what it will cost.

Do not wait until Q3 2025 to start this conversation. The businesses that are still scrambling in September 2025 will be the ones that did not plan ahead.

Network Segmentation: The Most Overlooked Protection in Small Business IT

When we assess a new client's network, we almost always find the same configuration: one Wi-Fi network that everyone uses — employees, guests, the owner's personal phone, the office printer, and sometimes a smart TV or two. Everything is on the same network, which means everything can talk to everything else.

This is a problem that most small business owners do not think about until something goes wrong. Here is why it matters.

A compromised guest device can reach your business systems. If a client or visitor connects to your Wi-Fi and their device is infected with malware, that malware can potentially scan your network and reach your file server, your accounting software, or your workstations. A guest network that is isolated from your business network eliminates this path entirely.

IoT devices are a persistent vulnerability. Smart TVs, security cameras, HVAC controllers, and other IoT devices often have poor security — default credentials, infrequent firmware updates, and limited logging. Putting them on a separate network segment means that a compromised IoT device cannot reach your business data.

Segmentation limits the blast radius of a ransomware attack. Ransomware spreads by moving laterally across a network — encrypting everything it can reach. A properly segmented network limits how far ransomware can spread before it is detected and contained. The difference between encrypting one workstation and encrypting your entire file server is often whether the network was segmented.

Implementing basic network segmentation — a separate guest network, IoT isolation, and VLAN separation for servers — is not a large project. For most small businesses, it is a half-day configuration change on existing equipment. The cost is low; the risk reduction is significant.

If you are not sure whether your network is segmented, it probably is not. We are glad to take a look.

Quick Tip: How to Check Whether Your Backups Are Actually Working

Last month we mentioned that we had seen several cases of backup jobs that were running but not completing successfully. Here is a simple check you can do right now:

1. Open your backup management console — whether that is Windows Server Backup, your cloud backup dashboard, or your managed backup portal.
2. Look at the last completed backup, not the last backup job that ran. These are different. A job can run and fail; you want to see a successful completion with a timestamp.
3. Check the size of the last completed backup. If it is significantly smaller than previous backups, something may have been excluded or the job may have partially failed.
4. Verify the restore point. The only way to know a backup actually works is to restore from it. Pick a non-critical file or folder and restore it to a test location. If the restore works, your backup is real. If it does not, you have found a problem before you needed the backup.

If you are not sure how to run this check, or if you find something that does not look right, call us. A backup that has not been tested is not a backup — it is a hope.

From the Team: What We Are Seeing in the Field

Cyber insurance renewals are getting harder. Several clients have come to us this month after receiving renewal questionnaires from their cyber insurers that are significantly more detailed than previous years. Insurers are asking specifically about MFA coverage, EDR deployment, backup isolation, and patch management cadence. If you have a renewal coming up and are not sure whether your current IT setup meets the requirements, reach out before you fill out the application — not after a claim is denied.

Microsoft 365 Copilot permissions issues. Businesses that have deployed Microsoft 365 Copilot are discovering that it surfaces data that employees did not realize was accessible to them — because the underlying SharePoint and OneDrive permissions were never properly configured. Copilot does not create new access; it makes existing access more visible. If you are planning a Copilot deployment, a permissions audit should come first.

End-of-year hardware procurement timelines. Supply chain lead times for business laptops and workstations have extended again heading into Q4. If you have hardware refreshes planned for early 2025, order now. Waiting until January means waiting until March.

Coming Up in November

• Cyber insurance for Florida small businesses: what policies actually cover and what they do not
• IT support for law firms: what your technology partner needs to understand about legal
• Remote work IT security: closing the gaps that hybrid work creates

If anything in this newsletter raised a question about your own environment, we are glad to help. BlueStream Consulting serves small and mid-sized businesses across Central Florida — Clermont, Kissimmee, Lakeland, Winter Garden, Tavares, and the greater Orlando area.

Call us at 352-432-4200 or visit our contact page to schedule a complimentary IT review.

— BlueStream Consulting Team

The most common way attackers get into a small business network is not through a sophisticated zero-day exploit. It is through a stolen, reused, or guessed password. According to Verizon's annual Data Breach Investigations Report, compromised credentials are involved in more than half of all confirmed data breaches — and that number has been consistent for years.

For small businesses, the problem is compounded by the way passwords are typically managed: employees choose their own, reuse them across personal and work accounts, write them on sticky notes, and share them with colleagues over email or text. Nobody is tracking which accounts exist, who has access to what, or when passwords were last changed.

This is not a technology problem. It is a process problem — and it has a practical solution.

Why Password Reuse Is a Business Risk, Not Just a Personal One

When an employee reuses a password across their work email and a personal account — a shopping site, a forum, a streaming service — they are creating a direct path from a consumer data breach to your business network.

Data breaches at consumer websites happen constantly. The credentials from those breaches are compiled into lists and sold on criminal marketplaces. Attackers then run those credentials against business email systems, VPNs, and cloud applications in a technique called credential stuffing. If your employee used the same password for their Netflix account and their Microsoft 365 login, an attacker who bought a Netflix breach list now has a working credential for your business.

This is not a hypothetical. It is one of the most common attack patterns we see when businesses call us after an incident.

What a Password Manager Actually Does

A business password manager solves the reuse problem by making it practical for employees to use a unique, complex password for every account — without having to remember any of them.

The way it works: the password manager generates a random, high-entropy password for each account (something like Kx9#mP2$vLqR7nWj) and stores it in an encrypted vault. The employee only needs to remember one master password to unlock the vault. When they need to log into an application, the password manager fills in the credential automatically.

For a business, the additional value is in the administrative controls:

• Centralized access management: IT administrators can see which accounts exist, who has access to shared credentials, and when passwords were last rotated — without being able to see the passwords themselves.
• Offboarding control: When an employee leaves, their access to the password vault is revoked immediately. Shared credentials they had access to can be rotated in minutes rather than days.
• Breach monitoring: Business password managers monitor known breach databases and alert you when a stored credential appears in a public breach — so you can change it before an attacker uses it.
• Policy enforcement: Administrators can enforce minimum password complexity, require MFA to unlock the vault, and prevent employees from storing personal credentials alongside business ones.

Business-grade password managers like 1Password Business, Bitwarden for Business, and Keeper Security are priced in the range of $3 to $6 per user per month. For most small businesses, this is the highest-return security investment available — it directly addresses the most common attack vector at a cost that is trivial compared to the cost of a breach.

Multi-Factor Authentication: The Second Line of Defense

A password manager dramatically reduces the risk of credential compromise, but it does not eliminate it entirely. Employees can still be phished into entering their credentials on a fake login page. The master password for the vault can be compromised if an employee's device is infected with malware.

Multi-factor authentication (MFA) is the control that limits the damage when a password is compromised. With MFA enabled, an attacker who has a valid username and password still cannot log in without the second factor — typically a time-based code from an authenticator app or a hardware security key.

MFA should be enabled on every business application that supports it, with priority given to:

• Email (Microsoft 365 or Google Workspace) — this is the highest-value target for attackers because email access enables password resets on every other account
• VPN and remote access systems
• Cloud storage and file sharing (SharePoint, OneDrive, Dropbox)
• Financial systems and banking portals
• The password manager itself

Microsoft 365 includes MFA at no additional cost. Enabling it for all users takes less than an hour and immediately reduces your risk of account compromise by more than 99 percent, according to Microsoft's own data. If your business is running Microsoft 365 and has not enabled MFA, that is the first thing to fix.

Privileged Accounts: The Credentials That Matter Most

Not all credentials carry the same risk. Administrator accounts — the accounts that can install software, change configurations, access all data, and create new users — are the ones attackers most want to compromise.

A few principles for managing privileged credentials:

Separate admin accounts from daily-use accounts. IT staff and business owners who need administrative access should have two accounts: a standard account for day-to-day work (email, documents, browsing) and a separate admin account used only for administrative tasks. If the daily-use account is compromised, the attacker does not automatically get admin access.

Never share admin credentials. Every administrator should have their own named account. Shared admin accounts make it impossible to audit who made a change, and they cannot be individually revoked when someone leaves.

Rotate service account passwords regularly. Applications and automated processes often use service accounts with passwords that were set during initial configuration and never changed. These are a common target because they are easy to overlook. Audit your service accounts annually and rotate their credentials.

The Offboarding Gap Most Businesses Miss

One of the most consistent findings in our security assessments is former employees who still have active credentials. An employee leaves — voluntarily or otherwise — and their accounts are not fully disabled. Their email is deactivated, but their VPN access remains. Their Microsoft 365 license is removed, but their login to the accounting software still works.

A complete offboarding checklist for credential security should include:

• Disable the Active Directory or Azure AD account immediately on the employee's last day
• Revoke access to all cloud applications — not just the ones IT manages, but the ones the employee set up themselves
• Rotate any shared credentials the employee had access to
• Remove the employee from the password manager and audit which vaults they could access
• Review email forwarding rules — departing employees sometimes set these up to maintain access to business communications
• Revoke any API keys or tokens associated with the employee's account

The challenge is that most small businesses do not have a complete inventory of which applications their employees have access to. A password manager helps here too — the vault audit shows exactly which credentials an employee had stored.

Password Policies That Actually Work

The traditional advice — require a complex password with uppercase, lowercase, numbers, and symbols, and force a change every 90 days — has been revised by NIST (the National Institute of Standards and Technology) based on research showing it does not improve security and often makes it worse.

When employees are forced to change passwords frequently, they make predictable changes: Password1! becomes Password2!. The complexity requirement leads to passwords written on sticky notes. The result is worse security, not better.

Current NIST guidance recommends:

• Length over complexity: A 16-character passphrase is more secure than an 8-character string of random characters and far easier to remember. Minimum length of 12 to 16 characters is the current standard.
• No mandatory rotation unless compromised: Passwords should be changed when there is evidence of compromise, not on an arbitrary schedule. Forced rotation without cause degrades security.
• Check against known breach lists: New passwords should be checked against databases of previously breached credentials. Most business password managers do this automatically.
• No complexity theater: Requiring a mix of character types does not meaningfully improve security when combined with a length requirement and breach checking.

Where BlueStream Consulting Can Help

BlueStream Consulting works with small and mid-sized businesses across Central Florida — Clermont, Winter Garden, Lakeland, Orlando, and the surrounding area — to build credential security programs that address real risk without creating friction that employees work around.

We can assess your current password practices, deploy and configure a business password manager, enable MFA across your Microsoft 365 environment, and build the offboarding procedures that ensure former employees cannot access your systems after they leave.

If you would like a straightforward review of your current credential security posture, call us at 352-432-4200 or reach out through our contact page. We will tell you exactly where you stand and what needs to change — without the sales pressure.