New Fathom It

09/01/2026

When an employee leaves your company, are you sure they actually lose access?

Disabling their email account isn’t enough.

A former employee may still have access to your VPN, accounting software, CRM, website, social media, shared passwords, cloud applications, or even an active session on a company device.

And you can’t remove access you don’t know exists.

In our latest blog, we look at why good offboarding actually starts during onboarding, how a company-managed password manager can help, and what a proper employee lockout process should include.

We also look at a real-world case where former employees attempted to access—and ultimately deleted—government databases immediately after being fired.

The question isn’t just:

“Did we disable their email?”

It’s:

“Are we certain they can no longer access the business?”

Read the full article: https://bit.ly/4631ZuT

Disabling an email account is not the same thing as offboarding an employee. In February 2025, two IT employees at a government contractor were fired d

08/28/2026

CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
https://bit.ly/4cELadq

CISA red teams reach domain-level compromise at two critical infrastructure organizations, but only one SOC detects and contains initial intrusion.

08/27/2026

Another great blog from Risky Business on Chinese AI-assisted hacking https://bit.ly/4qI07kM

Your weekly dose of Seriously Risky Business news is written by Tom Uren and edited by Amberleigh Jack and Patrick Gray. This week's edition is sponsored by Push Security. You can hear a podcast discussion of this newsletter by searching for "Risky Business News" in your podcatcher or subscribing

08/26/2026

More Incidents of AIs Going Rogue in Cybersecurity Challenges https://bit.ly/46ihXRY

The AI Security Institute has a new report of AI systems engaging in “unsanctioned behavior”—what I have been calling “genie behavior—while being tested on their cybersecurity capabilities. The incident stemmed from a single evaluation where agents were given a task of solving a cyber secu...

08/17/2026

Hacking Public Wi-Fi DNS to Steal Credentials
https://bit.ly/4bUPrt3

Criminals are hacking into public Wi-Fi devices—at hotels, conference centers, and so on—around the world and changing their DNS settings. The goal is to redirect users to fake login pages and steal their credentials.

07/22/2026

Ransomware attackers are changing tactics.

Phishing, malicious emails, and stolen credentials now cause more attacks than exploited vulnerabilities—and MFA alone isn’t enough.

Businesses need complete identity monitoring, and 24/7 threat response.

https://bit.ly/4gPmKkn

Phishing and malicious email now cause half of all ransomware attacks, overtaking vulnerabilities. MFA was deployed in 97% of credential-based attacks.

05/27/2026

Crypto ATM scams cost Americans $388M in 2025.

For small businesses, the lesson is broader: fraud succeeds when people are rushed, isolated, and told to bypass normal payment channels.

Train your team: verify odd payment requests before money moves. https://bit.ly/3Rp1kjm

The FBI says Americans have lost over $388 million last year to scams using cryptocurrency kiosks, also known as crypto ATMs or Bitcoin ATMs.

05/25/2026

Cybersecurity has had 20 years of “wake-up calls.” Breaches, ransomware, outages, cloud failures, vendor mistakes. For small businesses: don’t build around perfect prevention. Build for resilience: backups, MFA, patching, vendor review, and recovery plans.https://bit.ly/3PofdxJ

05/23/2026

The Mythos hype may be bigger than the breakthrough.

If multiple AI tools can find software flaws, the real takeaway for small businesses is practical: attackers will move faster, so patch faster, reduce exposed systems, and don’t let old software linger.https://bit.ly/435ktJB

The UK’s AI Security Institute evaluated GPT-5.5’s ability to find security vulnerabilities, and found that it is comparable to Claude Mythos. Note that the OpenAI model is generally available. Here is the Institute’s evaluation of Mythos. And here is an analysis of a smaller, cheaper model. I...

05/22/2026

BitLocker matters, but it should not be the only wall around your files.

For small businesses, this zero-day is a reminder to use device encryption, least-privilege access, sensitivity labels, rights management, and remote wipe. https://bit.ly/4eLsfj1

Security pros warn YellowKey claim could make stolen laptops a much bigger problem