SpySecure

12/11/2026

Your customer data has been stolen. The first 72 hours are not the time to work out your plan.

You may need to contain the attack, preserve evidence, determine what was taken, notify the local Data Protection Authority, inform customers and prepare for extortion or follow-up phishing.

At the same time, normal business must continue.

The companies that respond best already know:
• who makes decisions
• who investigates and contains the attack
• where customer data is stored
• which customers and authorities must be informed

Our new guide explains what an SME should prepare before a breach:
https://www.spysecure.nl/en/knowledge/data-breach-what-to-do-sme

Customer data stolen? What an SME must do after a data breach: who to inform, how fast, and how to prevent the next one.

10/11/2026

One simple question:

If a suspicious login or ransomware alert appears tonight, who sees it - and who can act?

A tool may generate an alert. It does not investigate what happened, block an account, isolate a device or coordinate the response by itself.

If the answer is "someone will look on Monday", the company is effectively unmonitored for most of the weekend.

24/7 security means 24/7 action, not just 24/7 software.

06/11/2026

A backup can return your data. It cannot return a working company.

After a serious cyberattack, you may need to investigate how the attackers entered, wipe and reinstall devices, reset accounts and MFA, review cloud settings and connected apps, restore clean data, rebuild integrations and test everything before employees can start again.

That is why recovery can take weeks even when backups exist. The recent disruption at Albert Heijn showed how quickly an IT incident can stop normal operations.

The less an attacker reaches, the less you have to rebuild. Early detection and fast response therefore matter just as much as tested, separate backups.

Our new article explains what recovery really involves:
https://www.spysecure.nl/en/knowledge/recovery-after-cyber-attack-sme

After a cyber attack you rebuild, not just restore. Why recovery takes weeks, why a backup is not enough and why stopping attacks early matters.

05/11/2026

Your company does not need to be selected to be attacked.

Many cyberattacks start with automated programs that test thousands of companies at once. They try leaked passwords, known vulnerabilities, open services and convincing phishing e-mails. Wherever a door opens, the attack continues.

That is why being smaller does not make an SME invisible. The practical question is whether your weakest entry point is easier to find than you realise.

We explain how these attacks work and the five measures that close the most common doors:
https://www.spysecure.nl/en/knowledge/cyber-attacks-smes-too-small

Think your company is too small for hackers? Why cyber attacks hit SMEs too, where attackers get in and 5 steps to stop them.

03/11/2026

The NCSC says "update now". Who checks that it actually happened?

Recent warnings about PHP, WordPress and other widely used software show how quickly a known vulnerability becomes a business issue.

Installing a patch is only one step. Someone must first know which devices, servers and applications are affected, prioritise what is exposed to the internet, install the update, check failed installations and confirm the vulnerability is gone.

A scan finds the gap. Active patch management closes it.

Our new guide explains what good patch management should look like for an SME:
https://www.spysecure.nl/en/knowledge/patch-management-sme-security-updates

Who installs security updates on your laptops, servers and firewall? A simple patch management guide for SMEs: who does what and what to fix first.

29/10/2026

Your software keeps changing. Your cybersecurity needs to keep up.

The FD reports a sharp increase in software vulnerability reports, with AI also giving attackers more capabilities.

New security flaws can be discovered in applications your business has used for years. Staying protected therefore takes ongoing attention, even after security software is installed.

Fully managed cybersecurity brings that work together: keeping devices and software updated, monitoring for suspicious activity and responding to threats, including outside office hours.

Your team keeps working with the systems it knows, while specialists look after the protection around them.

Read the FD article (free):
https://fd.nl/tech-en-innovatie/1617390/explosie-aan-meldingen-over-kwetsbare-software-dit-wordt-gevaarlijk?gift=DatYU

De toestroom aan meldingen over mogelijke toegangswegen voor hackers in software groeit explosief, blijkt uit onderzoek van het FD. Experts maken zich zorgen omdat IT-afdelingen het reparatiewerk nauwelijks aankunnen. Tientallen Nederlandse websites gingen afgelopen week tijdelijk op zwart, waaronde...

15/10/2026

An overall phishing score can hide which employees need additional support.

A useful monthly security training report should show:

• The overall company trend
• Training completion and test results
• Who opened or clicked a simulated phishing e-mail
• Who submitted information
• Whether additional training was completed

Individual results should be handled confidentially and used for targeted follow-up, not public blame.

Ask your employee training provider whether management receives both company-wide and per-employee results.

If the report only shows an average, it may hide the behaviour that creates the greatest risk.

13/10/2026

A company laptop does not automatically make an employee’s personal AI account company-managed.

An employee may sign in to Codex, Claude Code or another AI tool using a personal account.

The agent can then work with company files, code or repositories through that employee’s device.

But the company may not control:

• The AI account
• The connected repositories and integrations
• The permissions granted to the agent
• Access removal when the employee leaves
• The account settings and retained activity

This creates a gap between access to company data and control over the account using that access.

AI agents used for company work should use company-managed accounts with limited permissions and approved integrations.

Start by identifying which AI tools are currently connected to company systems through personal accounts.

09/10/2026

A guest account can outlive the project it was created for.

External users are often given access for a legitimate reason:

• A supplier needs a document
• A consultant joins a project team
• A customer accesses a shared environment
• A former employee supports a temporary handover

The problem starts when nobody removes or reviews that access afterwards.

A list of guest accounts is not enough. You also need to know:

• Which files, groups and applications each guest can access
• When the account was last used
• Which internal employee owns the relationship
• Whether the access is still required

Prioritise guests with access to sensitive information or administrator rights.

Guest access is useful. Guest access without an owner or regular review becomes a security gap.

See the seven Microsoft 365 and Google Workspace security gaps we repeatedly find:

https://www.spysecure.nl/en/knowledge/security-gaps-microsoft-entra-google-workspace?utm_source=linkedin&utm_medium=organic_social&utm_campaign=b1_m365_gaps&utm_content=p17_guest_access

100% of the new customers SpySecure® onboarded in 2026 had one or more of these 7 security gaps. See the risks and practical checks.

08/10/2026

Does your daily e-mail account also have administrator rights?

The account used for e-mail, web browsing and documents has a much higher chance of encountering a malicious link or file.

If that same account also has administrator rights, compromising it may give an attacker powerful access to Microsoft 365, Entra ID or Google Workspace.

Administrators should use:

• A normal account for daily work
• A separate named account for administrator tasks
• Strong MFA on the administrator account
• No shared administrator credentials

Ask your internal IT team or IT provider to export all privileged roles and confirm that every administrator uses a separate account.