Compex IT

02/09/2026

Adware is malware that forces unwanted advertisements onto your device, often without your knowledge or consent. It tracks your browsing, sells your data, and opens the door for worse threats to walk in.

Know the warning signs before your team clicks "Claim Now."

31/08/2026

Is your password here? A password manager generates and stores unique passwords for every account so you can rely on varied (and secure) password options for all your logins.

Don't get caught in the password graveyard...

28/08/2026

Your team connects to wifi at hotels, airports, and cafes without thinking about it. When that network has no password, or a password posted on the wall for everyone, the traffic between their laptop and the network isn't private. Someone else on the same network can potentially capture what's being sent, or set up a fake "Airport Free WiFi" hotspot that routes everything through their own machine.

Do this:
▶️ Use a VPN on any device that connects to public wifi. It scrambles the connection so anyone snooping sees gibberish. Most password managers and security suites include one, or your IT provider can set it up.
▶️ Better yet, skip public wifi for anything sensitive and use your phone's hotspot instead. A mobile connection is much harder to tamper with.
▶️ Turn off "auto-connect to open networks" on company phones and laptops, so devices don't join random hotspots on their own.

Most websites encrypt their own traffic now, so this is less risky than it used to be. But a VPN protects everything on the device, so it's worth setting up for anyone who travels for work.

26/08/2026

Think about everyone outside your company who has a login to your systems: the web developer from two years ago, the marketing freelancer, the bookkeeper who left in March. A lot of those accounts are probably still active.

These accounts are easy to forget because the people aren't your employees. But each one is a way into your business, and you have no idea how well that person guards their password.

Do this:
1. List every outside person and company with a login to your email, files, website, accounting, or any business system.
2. For each one, decide whether they still need it and when they last used it.
3. Turn off anything that's no longer needed, and ask your IT provider to set a reminder to review this again in six months.

For the access you keep, give each outside party their own named login, never a shared one. If something goes wrong, you'll want to know exactly whose account it was.

24/08/2026

Some of your company files may be readable by anyone on the internet who has the link, and you'd never know.

When you share a file in Google Drive, OneDrive, SharePoint, or Dropbox, you usually get two choices: share with specific people, or share with "anyone with the link." The second one is fast and easy, which is why people pick it. But a link can be forwarded, copied into an email, or left inside another document, and anyone who ends up with it can open the file, with no login or permission check needed.

Fix it:
✅ Change your default to share with named people or groups instead of "anyone with the link," so only the people you choose can open the file.
✅ Audit what's already open. In Google Drive, you can filter by "Shared" and review what's set to link access. In OneDrive or SharePoint, use "Manage access" on your sensitive files and folders.

Pay special attention to anything with customer data, financials, or contracts. Those are the files where open link-sharing does the most damage.

21/08/2026

Most of your team is probably running their computers as an administrator, and they shouldn't.

An administrator account can install software, change system settings, and switch off security tools. That's fine when it's you doing it on purpose. But any malware that lands on an admin account can do all of those same things. Run as a standard user instead, and a lot of attacks fail, because the malware doesn't have the rights to install itself.

Making the change breaks less than you'd think. Day to day, standard users run their normal apps with no difference at all. The only friction is installing new software, which now goes through whoever handles your IT. For most teams that's a fair trade for shutting down a whole category of attacks.

Ask your IT provider to review who has local admin rights on their machine. The answer is usually "more people than need it." Pull those rights back to the few who need them, and give everyone else a standard account.

19/08/2026

Your cyber insurance might not pay out, and you'd only find that out after an attack.

Insurers have spent the last few years tightening what they require. The application you sign is basically a security audit, and if you claim to have controls you don't have, the insurer can reduce your payout or deny the claim when something happens.

Most policies now expect:
✅ MFA on email, remote access, and every admin account. Missing or misconfigured MFA is one of the most common reasons claims get disputed.
✅ Real endpoint detection (EDR) on every machine, not just basic antivirus.
✅ Backups that are offline or immutable, and tested.
✅ Security awareness training you can show records for.

Plenty of businesses sign the renewal form, tick boxes they can't back up, and assume they're covered. The day you file a claim is the worst possible time to learn you weren't.

Pull your policy this week and read the conditions section. If it lists controls you're not sure you have, close that gap now, before you ever need to file.

17/08/2026

Right now, someone could send an email that looks like it came from your company, and your customers would have no reason to doubt it.

Email was never built to prove who a sender really is. By default, anyone can put your domain in the "From" line and send a fake invoice, a payment request, or a message to your staff that looks real.

Three DNS records fix this, and there's a good chance yours are missing or only half set up.

SPF lists the servers allowed to send email for your domain.
DKIM adds a signature that proves a message genuinely came from you and wasn't changed along the way.
DMARC ties those two together, tells receiving servers to reject anything that fails, and emails you a report of who's trying to impersonate you.

You can have all three records in place and still be wide open, because DMARC is often set to "monitor only" (p=none). That setting watches the spoofing happen without blocking it.

Ask your IT provider one question: "Is our DMARC set to reject, or just none?" If the answer is none, or they're not sure, that's what to fix.

14/08/2026

How to Introduce Microsoft 365 Copilot into Your Business Properly

With hype building everyday about the power of AI tools, many businesses are wondering if they should be introducing Microsoft 365 Copilot into the mix. Most people tend to assume it’s fairly simple. You buy the licences, switch it on, and tada! Everyone suddenly becomes faster, more product...

12/08/2026

How to Get Quick Wins from Microsoft 365 Copilot in Your First 30 Days

We’re beginning to see a bit of a pattern when businesses first start using Microsoft 365 Copilot. A business decides to invest in Copilot, licences are assigned, and there’s a genuine sense of excitement about what it might achieve. After all, we’ve all seen the headlines about AI be...