Newsletter Review Page

Welcome to the October 2026 edition of IT Insights & News — our monthly roundup of what is happening in IT and cybersecurity that matters to Central Florida businesses. If a colleague forwarded this to you, you can subscribe here.

This Month at a Glance

• Cybersecurity Awareness Month: what it actually means for your business
• Windows 10 End-of-Life: the clock is now under 12 months
• Network Segmentation: the most overlooked protection in small business IT
• Quick Tip: How to check whether your backups are actually working
• From the Team: What we are seeing in the field this month

Cybersecurity Awareness Month: Beyond the Posters

October is Cybersecurity Awareness Month — a designation that has existed since 2004 and that, if we are honest, has produced a lot of posters and not always a lot of change. We want to use this month to talk about what security awareness actually looks like when it works, versus what it looks like when it is just a compliance checkbox.

The checkbox version: send employees a phishing awareness email in October, maybe run a brief online training module, and call it done for the year. This approach satisfies an auditor who is looking for evidence of security training. It does not meaningfully change employee behavior.

The version that works looks different:

Simulated phishing campaigns run throughout the year, not just in October. The goal is not to catch employees — it is to give them low-stakes practice at recognizing and reporting suspicious messages. Employees who have clicked on a simulated phishing link and seen the immediate feedback are significantly more cautious with real phishing attempts. Running campaigns quarterly keeps the skill current.

Training is specific to the threats employees actually face. A generic "do not click suspicious links" module does not prepare employees for the AI-generated, contextually accurate phishing emails we described last month. Training should include real examples of current attack techniques — business email compromise, invoice fraud, fake IT support requests — not just theoretical scenarios.

Reporting is encouraged and frictionless. Employees who suspect a phishing attempt should have a clear, easy way to report it — and should feel confident that reporting is welcomed, not penalized. A culture where employees are afraid to admit they almost clicked something is a culture where real incidents go unreported.

Leadership participates visibly. Security culture starts at the top. When leadership treats security training as something that applies to everyone — including themselves — employees take it more seriously.

If your security awareness program has not been updated since before 2025, it is not addressing the current threat landscape. We can help you design a program that actually changes behavior. Call us at 352-432-4200.

Windows 10 End-of-Life: Under 12 Months and Counting

Microsoft will end support for Windows 10 on October 14, 2025. As of this newsletter, that is less than 12 months away. If your business has computers still running Windows 10, now is the time to act — not because the deadline is tomorrow, but because hardware assessments, procurement, imaging, and deployment take time, and businesses that start in Q1 2025 will be scrambling.

Here is where most businesses stand right now, based on what we are seeing across our client base:

Some computers can be upgraded to Windows 11 in place. If the hardware meets Windows 11 requirements — including TPM 2.0, which most computers manufactured after 2017 have — the upgrade is straightforward. The main work is testing application compatibility and planning the rollout so it does not disrupt operations.

Some computers need to be replaced. Older hardware that cannot run Windows 11 needs to be replaced before the deadline. If you have a significant number of machines in this category, procurement lead times and budget planning need to start now.

Extended Security Updates are a bridge, not a solution. Microsoft will offer paid Extended Security Updates (ESU) for Windows 10 after the end-of-life date. This buys time but does not eliminate the need to upgrade. ESU costs increase each year, and cyber insurers are beginning to ask about end-of-life operating systems in underwriting questionnaires.

The right first step is a complete inventory of your computers and their Windows versions. If you do not have that inventory, we can run one for you. From there, we can give you a clear picture of what the upgrade path looks like for your specific environment and what it will cost.

Do not wait until Q3 2025 to start this conversation. The businesses that are still scrambling in September 2025 will be the ones that did not plan ahead.

Network Segmentation: The Most Overlooked Protection in Small Business IT

When we assess a new client's network, we almost always find the same configuration: one Wi-Fi network that everyone uses — employees, guests, the owner's personal phone, the office printer, and sometimes a smart TV or two. Everything is on the same network, which means everything can talk to everything else.

This is a problem that most small business owners do not think about until something goes wrong. Here is why it matters.

A compromised guest device can reach your business systems. If a client or visitor connects to your Wi-Fi and their device is infected with malware, that malware can potentially scan your network and reach your file server, your accounting software, or your workstations. A guest network that is isolated from your business network eliminates this path entirely.

IoT devices are a persistent vulnerability. Smart TVs, security cameras, HVAC controllers, and other IoT devices often have poor security — default credentials, infrequent firmware updates, and limited logging. Putting them on a separate network segment means that a compromised IoT device cannot reach your business data.

Segmentation limits the blast radius of a ransomware attack. Ransomware spreads by moving laterally across a network — encrypting everything it can reach. A properly segmented network limits how far ransomware can spread before it is detected and contained. The difference between encrypting one workstation and encrypting your entire file server is often whether the network was segmented.

Implementing basic network segmentation — a separate guest network, IoT isolation, and VLAN separation for servers — is not a large project. For most small businesses, it is a half-day configuration change on existing equipment. The cost is low; the risk reduction is significant.

If you are not sure whether your network is segmented, it probably is not. We are glad to take a look.

Quick Tip: How to Check Whether Your Backups Are Actually Working

Last month we mentioned that we had seen several cases of backup jobs that were running but not completing successfully. Here is a simple check you can do right now:

1. Open your backup management console — whether that is Windows Server Backup, your cloud backup dashboard, or your managed backup portal.
2. Look at the last completed backup, not the last backup job that ran. These are different. A job can run and fail; you want to see a successful completion with a timestamp.
3. Check the size of the last completed backup. If it is significantly smaller than previous backups, something may have been excluded or the job may have partially failed.
4. Verify the restore point. The only way to know a backup actually works is to restore from it. Pick a non-critical file or folder and restore it to a test location. If the restore works, your backup is real. If it does not, you have found a problem before you needed the backup.

If you are not sure how to run this check, or if you find something that does not look right, call us. A backup that has not been tested is not a backup — it is a hope.

From the Team: What We Are Seeing in the Field

Cyber insurance renewals are getting harder. Several clients have come to us this month after receiving renewal questionnaires from their cyber insurers that are significantly more detailed than previous years. Insurers are asking specifically about MFA coverage, EDR deployment, backup isolation, and patch management cadence. If you have a renewal coming up and are not sure whether your current IT setup meets the requirements, reach out before you fill out the application — not after a claim is denied.

Microsoft 365 Copilot permissions issues. Businesses that have deployed Microsoft 365 Copilot are discovering that it surfaces data that employees did not realize was accessible to them — because the underlying SharePoint and OneDrive permissions were never properly configured. Copilot does not create new access; it makes existing access more visible. If you are planning a Copilot deployment, a permissions audit should come first.

End-of-year hardware procurement timelines. Supply chain lead times for business laptops and workstations have extended again heading into Q4. If you have hardware refreshes planned for early 2025, order now. Waiting until January means waiting until March.

Coming Up in November

• Cyber insurance for Florida small businesses: what policies actually cover and what they do not
• IT support for law firms: what your technology partner needs to understand about legal
• Remote work IT security: closing the gaps that hybrid work creates

If anything in this newsletter raised a question about your own environment, we are glad to help. BlueStream Consulting serves small and mid-sized businesses across Central Florida — Clermont, Kissimmee, Lakeland, Winter Garden, Tavares, and the greater Orlando area.

Call us at 352-432-4200 or visit our contact page to schedule a complimentary IT review.

— BlueStream Consulting Team