LuzGrid Tech Blog
IT & cybersecurity, plain English.
Practical advice from a Rancho Cucamonga MSP. No jargon, no fluff — what small business owners actually need to know.
What to Do in Case of a Cyberattack (Step by Step)
If your business is hit by a cyberattack, the first hour matters. Disconnect the affected devices from the network instead of powering them off, call your IT provider by phone, and leave the evidence in place. If money was wired to a scammer, call your bank right away. This post is the step-by-step plan, plus where to report an attack in the US, UK, and Australia.
Who Can See What Your AI Note-Taker Records?
AI note-takers join your meetings, transcribe everything said, and save the recording and summary to the vendor's servers. Who can see that recording depends on the tool. Some keep your data inside your own Microsoft or Google environment and never use it for training, while others store it on their own servers and may use it to improve their AI. Some also auto-join meetings from your calendar without anyone pressing record. Before you let one into a client or staff meeting, it's worth knowing where the recording goes and getting everyone's consent.
QR Code Scams: What They Are and How to Protect Your Business
A QR code scam, sometimes called quishing, hides a malicious web link inside a QR code. Because the link is buried in an image instead of written as text, it slips past the email filters that normally catch bad links, and scanning the code usually moves the victim onto a personal phone that sits outside the company's security. Microsoft reported a 146% rise in QR code phishing during the first quarter of 2026.
What Are Passkeys, and Should Your Business Use Them?
A passkey lets you sign in to an app or website using the same fingerprint, face, or PIN you use to unlock your phone or laptop, with no password to type. It's built on a security standard called FIDO that can't be phished, because the passkey only works on the real site and there's no password to steal or reuse. Most major platforms and a growing list of business tools support passkeys, and Microsoft 365 includes them at no extra cost. For most businesses, it's worth starting to roll them out, beginning with the most sensitive accounts.
How to Stop Scammers from Sending Emails in Your Company's Name
Email spoofing is when a scammer sends a message that appears to come from your domain, often to trick your clients or staff into paying a fake invoice or changing banking details. Three DNS records (SPF, DKIM, and DMARC) prove that a message really came from you and tell receiving mail servers to reject the ones that didn't. The catch is that DMARC only protects you once it's set to "quarantine" or "reject," and a lot of businesses leave it on "none," which monitors but does not block.
Still on Windows 10? Here's Why You're Putting Your Business at Risk
Windows 10 reached the end of Microsoft support on October 14, 2025, which means it no longer gets security updates. The computers still work, but any new flaw found in Windows 10 will never be fixed, which makes them easier to attack and can cause problems with compliance and cyber insurance. You have three options: upgrade eligible PCs to Windows 11 for free, pay for Extended Security Updates as a short-term bridge, or replace machines too old to upgrade.
How Small Business Ransomware Attacks Work (And How to Protect Against Them)
Most ransomware operations target small businesses at volume, running through dozens of prospects per month. A 22-person company can be researched in 40 minutes using public records, attacked using session-token theft after a single phishing click, and ransomed within a week. What follows is a step-by-step walkthrough of how that attack unfolds, written from the attacker's perspective, plus the five specific controls that would have stopped it. Each control is included in security tools small businesses already pay for.
How to Prepare Microsoft 365 Permissions for a Safe Copilot Rollout
Microsoft 365 Copilot retrieves files, emails, and chats using each user's existing Microsoft 365 permissions. In most tenants, those permissions are broader than anyone has mapped, because access accumulates across years of projects and staff changes. A safe Copilot rollout begins with auditing those permissions, fixing the gaps, and applying sensitivity labels to confidential content. Microsoft publishes specific guidance on this cleanup, structured into a pilot, deploy, and operate sequence.
Why Bad Onboarding Is the Real Cause of Messy Offboarding
Offboarding is the final step of a process that started on the employee's first day. Shared logins, forgotten SaaS subscriptions, untracked personal devices, and client relationships locked inside one person's inbox are almost always traceable to informal onboarding shortcuts taken months earlier. Tightening the onboarding side turns each future departure into a 90-minute checklist instead of a three-week cleanup.
How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy
Cyber insurance applications have grown longer because of specific claim trends from 2023 and 2024, including the MOVEit supply-chain breach, the Change Healthcare ransomware incident, and the Arup deepfake wire fraud. Each new section asks about specific security controls including immutable backups, layered MFA, callback verification on wires, EDR or MDR coverage, vendor risk, and tested incident response. Answers that overstate your security posture can trigger rescission after a claim, meaning the policy is treated as if it never existed.
What Immutable Backup Means on Your Cyber Insurance Form
Immutable backups are backup copies that nobody can change or delete during a fixed retention period, including administrators and attackers using stolen credentials. Cyber insurance carriers ask about them on renewal applications because ransomware operators routinely destroy backups before encrypting production systems. A backup sitting on your network under regular admin credentials does not qualify.
5 Microsoft 365 Settings Worth Checking in Your Tenant
Microsoft has tightened several Microsoft 365 defaults over the past few years, but those changes do not always apply retroactively. Tenants set up before 2022, or configured by a previous IT provider and left alone since, often still have legacy settings in place around file sharing, external email forwarding, third-party app consent, audit log retention, and MFA enforcement. Five settings worth verifying.
Playbook: How a Small Insurance Agency Should Build a NIST CSF-Mapped WISP for Carrier Questionnaires
When a small independent insurance agency receives a carrier's annual security questionnaire that requires a full NIST CSF mapping of controls, what does the right engagement look like? Here is the playbook — what we would assess, what we would change, and what the agency should see when this is handled properly.
How to Vet Your IT Provider in 30 Minutes (Questions, Red Flags, What Good Looks Like)
A 30-minute checklist any non-technical small business owner can run on a discovery call. The questions that separate a real MSP from a sales rep, the red flags to listen for, and what a good answer actually sounds like.
What Happens When Ransomware Hits a 25-Person Firm in Riverside (a Realistic Timeline + What Stops It)
Ransomware does not arrive announced. It walks in through email, sits quietly for days or weeks, and detonates on a Friday night when nobody is watching. Here is the realistic timeline for a 25-person Riverside firm — and the controls that would have changed the ending.
The MSP Question Every Rancho Cucamonga Business Should Ask Before Signing
Most managed services pitches sound the same: 24/7 monitoring, unlimited helpdesk, proactive maintenance. Here is the one question that actually separates a good MSP from a bad one — and the supporting questions that flush out the truth.
Your Dental Office IT Compliance Checklist (HIPAA + State Board + the Things They Don't Tell You)
Dental offices in California live at the intersection of HIPAA, the Dental Board, and a stack of practice-management software vendors. Here is the realistic IT compliance checklist for a 5- to 25-operatory practice — the things you have to do, the things you should do, and the gaps everyone misses.
Why Most Small Businesses Are Easier to Hack Than They Think (and the 5-Step Fix)
Whether you run a 5-person shop or a 50-person firm, the truth is that attackers don't care about your size — and your defenses are usually thinner than you think. Here's why, and the 5-step fix that closes most of the gap in a few weeks.
Playbook: How a $400M+ AUM RIA Should Prepare for an SEC Exam Under the 2024 Reg S-P Amendments
When a small RIA managing $400M+ AUM faces an SEC exam under the 2024 Reg S-P amendments, what does the right engagement look like? Here is the playbook — what we would assess, what we would change, and what the firm should see when this is handled properly.
Playbook: How a Property Management Firm Should Handle a Departing-Employee Data Exfiltration Risk
When a property management firm faces a departing employee who may be copying client and tenant files on their way out, what does the right engagement look like? Here is the playbook — what we would assess, what we would change, and what the firm should see when the next departure is handled properly.
Micro-SaaS Vetting: The 5-Minute Security Check for Browser Extensions
That browser extension your team installed in 30 seconds could be reading everything they do online. Here's a 5-minute vetting process that should be standard.
The Backup Exit Strategy: Can You Move Your Data Without the Vendor's Help?
SaaS tools make it easy to get your data in — but can you get it out? Here's why data portability matters and how to avoid the proprietary trap.
Clean Desk 2.0: Securing Your Home Office from Physical Data Leaks
The clean desk policy has evolved. In a world of remote work and AI tools, an unlocked screen is a data breach waiting to happen. Here's the modern version.
The Legacy Debt Audit: Identifying the 3 Oldest Risks in Your Server Room
That old server still works — until it doesn't. Here's how to find and prioritize the silent risks hiding in your infrastructure before they become emergencies.
The Session Cookie Hijack: Why MFA Can't Always Save You
Multi-factor authentication is essential — but attackers have found ways around it. Here's how session cookie hijacking works and what layered defenses you actually need.
LinkedIn Social Engineering: Protecting Your Staff from Fake Recruitment Scams
Fake recruiters on LinkedIn are getting harder to spot. Here's the scam pattern your team needs to recognize — and the simple defaults that stop it.
Playbook: How a Two-Location Dental Practice Should Respond to a Lookalike-Domain Phishing Attempt
When a two-location dental practice faces a lookalike-domain phishing attempt targeting the front desk, what does the right engagement look like? Here is the playbook — what we would assess, what we would change, and what the practice should see when this is handled properly.
The Home-Office Laptop Checklist We Wish Every Small Business Used
Most home-office security incidents aren't dramatic. They're small habits multiplied — a screen left unlocked, a router with the default password, a quick "just checking something" from a family member. Here's the simple checklist that catches the boring stuff.
Stop Ransomware Before It Starts: A 5-Step Plan That Works
Ransomware almost never starts with encryption. It starts days or weeks earlier with a stolen login or an unpatched system. The fix isn't fancy — it's five fundamentals done consistently.
Playbook: How a 9-Person CPA Firm Should Respond to a Tax Software Portal Vulnerability During Tax Season
When a 9-person CPA firm faces a credential-stuffing wave against its tax-prep platform vendor mid-tax-season, what does the right engagement look like? Here is the playbook — what we would assess, what we would change, and what the firm should see when this is handled properly.
The 2026 Guide to Finding the Cloud Apps Your Team Is Actually Using
Most IT teams think their company uses 30-40 cloud apps. The real number is closer to 1,000. Here's how to find what's actually running, decide what stays, and replace what doesn't — without driving everyone to a worse workaround.
How to Run a Shadow AI Audit Without Slowing Your Team Down
Shadow AI is what happens when AI tools spread faster than the rules. People aren't trying to break things — they're trying to save time. Here's how to find what's in use and decide what to do with it, without making your team feel watched.
A Practical Zero Trust Roadmap for Small Businesses
Most small business breaches don't happen because there's no security. They happen because one stolen password gets to be a master key. Zero Trust is how you break that chain — without turning your team into part-time IT staff.
The 5 Security Layers Most Small Businesses Are Missing
Most small businesses didn't build security wrong. They built it one tool at a time, and the gaps usually live where the tools don't talk to each other. Here are the five layers we see missing most often.
Get our newsletter
Short, practical IT notes for SMB owners — sent every other week. No pitch, no fluff.