Most breaches don’t need a genius. They need a flaw that already has a fix, at a business that hasn’t installed it yet. Jason Russell follows a made-up Central Florida accounting firm whose firewall sat unpatched for two months, right up to the week before the tax deadline, then shows the boring habits that would have made the attack a non-event.

Along the way: why a published fix is also a map for criminals, why small businesses fall behind, and the free government list that tells you what to patch first.

In this episode

• The most common way in. Exploited software flaws were the top entry point in 31% of breaches in Verizon’s 2026 report and 32% of intrusions in Mandiant’s M-Trends 2026.
• The speed problem. Mandiant estimates attackers now exploit flaws about seven days before a fix is even released, on average.
• Most businesses are behind. Only 26% of actively exploited flaws were fully fixed, and the median fix took 43 days.
• Why patching gets skipped. Fear of breaking things, nobody owning it, forgotten devices, vendor software, and equipment that no longer gets fixes.
• Four habits that fix it. Know what you have, let automatic updates handle the easy stuff, put the firewall and network gear on a calendar, and patch what’s under attack first.
• CISA’s patch-this-first list. What the Known Exploited Vulnerabilities catalog is, how to get free alerts, and the two questions to ask your IT provider.

Your one thing this week: take a picture of every box with a blinking light in your network closet, and find out when each one last got an update.

Chapters

• 0:00 Intro
• 0:10 Three days before the tax deadline
• 1:06 What a patch is, and why it’s also a map
• 2:04 Why patching matters
• 4:12 How the firm got breached
• 5:08 Why small businesses skip it
• 7:06 Four habits that make it routine
• 9:31 The patch-this-first list
• 11:07 The same story, done right
• 12:16 Your one thing this week
• 12:32 How to reach Jason

Mentioned in this episode

• Episode 3: How to Vet a Managed IT Provider
• Episode 4: Don’t Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)
• Episode 5: Ransomware, Explained Without the Jargon
• CISA Known Exploited Vulnerabilities Catalog

Sources

• Verizon, 2026 Data Breach Investigations Report
• Google Cloud / Mandiant, M-Trends 2026
• Sophos, The State of Ransomware 2026
• Coveware by Veeam, Q2 2026 Quarterly Report
• CISA, Known Exploited Vulnerabilities Catalog

Want help building your equipment list?

Email Jason directly at jason@harmony-msp.com. Send him your network closet photos, and he’ll help you figure out what’s overdue and what to fix first.

Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

Ransomware rarely hits in one bad click. It's closer to a burglary that takes weeks, and every one of those weeks is a chance to stop it. Jason Russell follows a made-up Central Florida dental practice through a realistic attack, from one stolen password to a locked office on a Monday morning, then shows what would have changed the ending.

Along the way: why attackers mostly log in instead of breaking in, why the ransom usually isn't the biggest bill, and what paying actually buys you.

In this episode

• The four stages of an attack. Get in, look around, take, lock, and why 79% of attacks in Sophos's 2026 survey started with someone's login.
• The forgotten door. Among victims whose attack began with a stolen password, 97% had MFA turned on somewhere. Somewhere is the problem.
• What it really costs. Median recovery cost was $375,000 before any ransom, and the average recovery took three weeks.
• The HIPAA angle. Why HHS presumes ransomware on patient data is a reportable breach, and what that means for medical and dental practices.
• Should you pay? Why the FBI says no, and what law enforcement found when it took down LockBit.
• What actually stops it. MFA on every login, someone watching around the clock, backups that can't be deleted, and a plan on paper.

Your one thing this week: list every way someone can log in to your business from the outside, and find out which ones don't have MFA.

Chapters

• 0:00 Intro
• 0:10 A Monday morning at a dental practice
• 1:06 Ransomware in plain English
• 2:00 Too small to be a target?
• 2:37 How an attack unfolds
• 5:30 What it really costs
• 7:14 Should you pay?
• 8:12 What actually stops it
• 11:27 The same story, done right
• 12:18 Your one thing this week
• 12:49 How to reach Jason

Mentioned in this episode

• Episode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy
• Episode 4: Don't Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)

Sources

• Sophos, The State of Ransomware 2026
• Coveware by Veeam, Q2 2026 Quarterly Report
• Verizon, 2026 Data Breach Investigations Report
• FBI, Ransomware
• HHS, Fact Sheet: Ransomware and HIPAA
• FBI Internet Crime Complaint Center (report an attack)

Want a second set of eyes on your login list?

Email Jason directly at jason@harmony-msp.com. Send him the list, and he'll help you find the doors you forgot about.

Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

Without any special tools and without breaking into anything, a stranger can send an email that appears to come from your business. Your domain in the From line. A short, reasonable request: pay this invoice, or update the account we send payments to. Your client opens it, because why wouldn't they.

In this episode, Jason Russell walks through why email was built this way, and the three DNS records that make spoofing much harder to pull off: SPF, the list of servers allowed to send for your domain; DKIM, the tamper-proof signature on every message; and DMARC, the rule that ties them together and tells receiving servers what to do when something fails.

Then the part most businesses miss. DMARC has three policy settings, and the most common mistake is stopping at the first one. A domain sitting at p=none gets you reports about being spoofed — not protection from it. CISA treats that setting as a temporary step toward reject, not a finish line.

The episode closes with what these records genuinely cannot stop: lookalike domains and display-name spoofing, both of which show up constantly in wire fraud aimed at law firms and title companies. Records handle the easy version of the attack. A verification habit handles the rest.

You'll finish this one knowing exactly what to ask your IT provider, and how to tell whether the answer you get is a real answer.

In this episode

• (0:00) Why someone can send mail in your name right now
• (1:40) The envelope analogy: why email never verified senders
• (3:30) SPF — the list of who's allowed to send
• (5:00) DKIM — the signature that proves nothing was altered
• (6:15) DMARC — the rule that ties it together
• (8:15) The p=none trap, and why it isn't protection
• (10:00) What these records don't stop: lookalike domains and display-name spoofing
• (12:00) Why this matters even if you barely send email
• (13:30) The three-step rollout, in order
• (15:00) What to do this week

Key takeaways

• Email doesn't verify senders on its own. Your domain is forgeable until you configure it otherwise.
• SPF lists authorized servers, DKIM signs messages, DMARC decides what happens on failure and reports who's using your domain.
• p=none is monitoring, not protection. Real protection starts at quarantine and lives at reject.
• Free checkers confirm records exist — not that they're configured correctly, which is where most problems hide.
• Neither DMARC nor anything else catches lookalike domains or display-name spoofing. Verify payment changes by phone, using a number you already have.

Resources

• Companion article: How to Stop Someone From Sending Email in Your Company's Name — https://harmony-msp.com/how-to-stop-someone-from-sending-email-in-your-companys-name/
• CISA Binding Operational Directive 18-01, Enhance Email and Web Security — https://www.cisa.gov/binding-operational-directive-18-01
• Google Email Sender Guidelines FAQ — https://support.google.com/mail/answer/14229414
• Microsoft, "Strengthening the Email Ecosystem: Outlook's New Requirements for High-Volume Senders" — https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730
• Law firm IT and security — https://harmony-msp.com/industries-we-serve/law-firm/
• Medical and dental practice IT and security — https://harmony-msp.com/industries-we-serve/medical-dental-practices/

Your cyber insurance renewal questionnaire got longer this year, and it isn't because you did something wrong. It's because carriers paid out on a run of very expensive claims and started asking sharper questions.

Here's what most business owners don't realize: that application is a warranty document. Every box you check is a legal promise about how your business actually operates. If a forensic investigation after a claim finds your environment didn't match what you wrote down, the carrier can rescind the policy, which means your claim is denied and prior payouts can be clawed back. Some courts have held that the carrier doesn't even have to prove the misrepresentation caused the loss.

In this episode, Jason Russell walks through the three incidents that rewrote the modern cyber insurance application, what underwriters are really asking in each section, and how to answer accurately when you know you have a gap.

You'll learn:

• Why MOVEit, Change Healthcare, and the Arup deepfake fraud are behind nearly every new question on your form
• What "immutable" and "air-gapped" actually mean, and why "we back up Microsoft 365" no longer clears the bar
• The five places MFA has to be turned on to pass clean, and why SMS codes are now the weak answer
• The privileged access management question most owners have never seen before
• Callback verification for wire transfers, and what carriers now refuse to cover at all
• The difference between EDR and MDR, and how to answer when you don't have MDR yet
• Why rescission is a worse outcome than any premium increase
• A 30-day pre-renewal checklist you can work through before you sign

The short version: an honest application with a couple of gaps and a plan is a policy that will still be there when you need it. A perfect-looking application that doesn't match your network is an expensive piece of paper.

Most small business owners didn't sign up to run security for their company. They signed up to practice dentistry, represent clients, file returns, or build something. The technology came with the job — and so did the risk.

Ctrl+Alt+Protect is a show for those owners and the people who keep their offices running.

Host Jason Russell spent more than eight years in the U.S. Navy as a cryptologic technician, running shipboard networks and encrypted communications during tactical operations. He went on to work at the National Security Agency as a network security consultant, then spent four years in Iraq leading the Multi-National Division–Baghdad Tactical Biometrics Cell and a team of forty field support engineers. In 2011 he brought that work home to Central Florida and founded what is now Harmony MSP, where he works with small businesses, medical and dental practices, law firms, and accounting firms.

In this trailer, Jason lays out what the show covers and how: one topic per episode, explained plainly. Why the email from your bookkeeper might not be from your bookkeeper. What a cyber insurance application is actually asking you to certify. Which items on a vendor's proposal matter, and which you can pass on.