Most breaches don’t need a genius. They need a flaw that already has a fix, at a business that hasn’t installed it yet. Jason Russell follows a made-up Central Florida accounting firm whose firewall sat unpatched for two months, right up to the week before the tax deadline, then shows the boring habits that would have made the attack a non-event.

Along the way: why a published fix is also a map for criminals, why small businesses fall behind, and the free government list that tells you what to patch first.

In this episode

• The most common way in. Exploited software flaws were the top entry point in 31% of breaches in Verizon’s 2026 report and 32% of intrusions in Mandiant’s M-Trends 2026.
• The speed problem. Mandiant estimates attackers now exploit flaws about seven days before a fix is even released, on average.
• Most businesses are behind. Only 26% of actively exploited flaws were fully fixed, and the median fix took 43 days.
• Why patching gets skipped. Fear of breaking things, nobody owning it, forgotten devices, vendor software, and equipment that no longer gets fixes.
• Four habits that fix it. Know what you have, let automatic updates handle the easy stuff, put the firewall and network gear on a calendar, and patch what’s under attack first.
• CISA’s patch-this-first list. What the Known Exploited Vulnerabilities catalog is, how to get free alerts, and the two questions to ask your IT provider.

Your one thing this week: take a picture of every box with a blinking light in your network closet, and find out when each one last got an update.

Chapters

• 0:00 Intro
• 0:10 Three days before the tax deadline
• 1:06 What a patch is, and why it’s also a map
• 2:04 Why patching matters
• 4:12 How the firm got breached
• 5:08 Why small businesses skip it
• 7:06 Four habits that make it routine
• 9:31 The patch-this-first list
• 11:07 The same story, done right
• 12:16 Your one thing this week
• 12:32 How to reach Jason

Mentioned in this episode

• Episode 3: How to Vet a Managed IT Provider
• Episode 4: Don’t Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)
• Episode 5: Ransomware, Explained Without the Jargon
• CISA Known Exploited Vulnerabilities Catalog

Sources

• Verizon, 2026 Data Breach Investigations Report
• Google Cloud / Mandiant, M-Trends 2026
• Sophos, The State of Ransomware 2026
• Coveware by Veeam, Q2 2026 Quarterly Report
• CISA, Known Exploited Vulnerabilities Catalog

Want help building your equipment list?

Email Jason directly at jason@harmony-msp.com. Send him your network closet photos, and he’ll help you figure out what’s overdue and what to fix first.

Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com