Incident reports
Every problem, written down.
90 reports and counting: 38 real incidents we fixed for East Tennessee businesses, and 52 plain-English guides to the rules they answer to.
01Guides
Windows 10 Extended Security Updates: What Businesses Get, and When to Stop Paying
Windows 10 support ended Oct 14, 2025. Business ESU buys up to three years of security-only patches, one year at a time, and Year 1 ends Oct 13, 2026.02GuidesWhat Is MDM? Mobile Device Management for Regulated Small Firms
MDM is software that enrolls your laptops and phones so IT can push settings, require encryption, control apps, and lock or wipe a lost device remotely.03GuidesWhat Is FCI? Federal Contract Information for Small DoD Suppliers
FCI is non-public information provided by or generated for the government under a contract. If your systems hold it, FAR 52.204-21 and CMMC Level 1 apply.04GuidesWhat Is DMARC? SPF, DKIM, and DMARC Explained for Small Firms
DMARC is a DNS record that tells receiving mail servers what to do with mail that fails SPF and DKIM checks for your domain, and sends you reports on it.05GuidesWhat Is CUI? Controlled Unclassified Information for Machine Shops
CUI is government information that a law or policy says must be protected, like DoD drawings marked CUI//SP-CTI. Holding it puts you under NIST 800-171.06GuidesWhat Is CMMC? The DoD Cybersecurity Rule, Explained for Small Shops
CMMC is the DoD's program for proving contractors protect FCI and CUI. Three levels, phased in from November 10, 2025, and paused in Phase 1 since July 2026.07GuidesWhat Is a Managed Service Provider? What an MSP Actually Does
A managed service provider (MSP) runs your IT for a flat monthly fee: monitoring, patching, security, help desk. It's paid to prevent problems, not fix them.08GuidesSystem Security Plan Template: What a CMMC Level 2 SSP Has to Say
An SSP describes your CUI system's boundary, environment, how each NIST 800-171 requirement is met, and its connections. CMMC Level 2 needs one.09GuidesSPRS Score: How the DoD Scores Your NIST 800-171 Work, and How to Calculate Yours
Your SPRS score starts at 110 and loses 1, 3, or 5 points for each NIST SP 800-171 requirement you haven't met. It can go as low as -203.10GuidesSocGholish Fake Browser Update: What to Do If Someone Clicked It
SocGholish shows a fake browser update on a real, hacked website. If someone ran the file, unplug that PC and call IT. It's an entry point for ransomware.11GuidesHow to Know if Your Computer Is Hacked: Real Signs vs. False Alarms
Real signs a work computer is hacked: remote-access apps you didn't install, new inbox rules, MFA prompts you didn't trigger, antivirus off. What to do next.12GuidesQuickBooks Scam Email: How to Spot a Fake Intuit Invoice or Support Call
A QuickBooks scam email fakes an invoice, failed payment, or suspension notice. Don't click or call the number in it. Sign in to QuickBooks yourself to check.13GuidesQuishing: What to Do When Someone Scans a QR Code Phishing Email
Quishing is phishing with a QR code. It moves the login to a phone your email filter cannot see. If someone signed in, revoke sessions, not just the password.14GuidesQilin Ransomware: What to Do First, and Why It's a Breach Question
Qilin (formerly Agenda) is ransomware that steals files before encrypting them. Isolate machines, don't pay or wipe, call IT, and plan for breach notice.15GuidesPOA&M for CMMC: What a Plan of Action and Milestones Can and Can't Cover
A POA&M lists the security gaps you haven't closed and how you'll close them. CMMC allows one at Level 2 only with 88 of 110 and 180 days to close.16GuidesPhishing-Resistant MFA: Why Text Codes and Push Prompts Aren't Enough
Phishing-resistant MFA ties the login to the real site, so a fake page gets nothing it can use. That means FIDO2 security keys, passkeys, or smart cards.17GuidesNIST 800-171 Rev 3: What Changed, and Why DoD Contractors Still Build to Rev 2
NIST SP 800-171 Rev 3 cut the list to 97 requirements and added fill-in-the-blank parameters. DoD contracts and CMMC still assess against Rev 2. Build to Rev 2.18GuidesMicrosoft 365 Business Premium vs E3: Which License Fits a Regulated Firm
Under 300 users, Business Premium gives most regulated firms the security they need. E3 fits past 300 seats; E5 adds risk-based access and deeper compliance.19GuidesMedusa Ransomware: What the CISA/FBI Advisory Means for a Small Firm
Medusa is ransomware-as-a-service that steals your files, then encrypts them. Isolate machines, don't pay or wipe anything, call IT, and report it to the FBI.20GuidesMalvertising: When the Top Search Result for Zoom or Teams Is Malware
Malvertising is a paid search ad that impersonates real software and serves malware. If someone installed one, unplug the PC and call IT before anything else.21GuidesInfostealer Malware: What Lumma, RedLine, and Vidar Steal and What to Do Next
Lumma, RedLine, and Vidar steal saved passwords and login cookies. Isolate the PC, reimage it, then reset passwords and sessions from a clean device.22GuidesIncident Response Plan Template for Small Regulated Firms
A small-firm incident response plan needs eight sections: roles, declaring an incident, containment, outside calls, notices, evidence, recovery, and review.23GuidesHIPAA Compliant Texting: What Staff Can Send, and on Which Phone
HIPAA doesn't ban texting. Patients can ask for texts, and staff can text PHI to the care team, but only through an app with a BAA on a managed phone.24GuidesHIPAA Compliance Checklist for Small Medical and Dental Practices
A HIPAA compliance checklist covers the Security Rule's three safeguard groups, Privacy Rule basics, and breach notice. IT owns about half of it.25GuidesGoogle Workspace vs Microsoft 365 for Regulated Small Firms
Microsoft 365 fits firms that run on Outlook, Excel, and Windows. Google Workspace fits browser-first teams. Both work for regulated firms once locked down.26GuidesGCC High for CMMC: When a Small Defense Shop Actually Needs It
GCC High is a separate Microsoft 365 US government cloud for DoD CUI and ITAR data. Microsoft signs ITAR terms only for it, and moving in means a new tenant.27GuidesFake DocuSign Email? How to Spot It and What to Do If You Signed In
A fake DocuSign email leads to a page that steals your password. Open envelopes via Access Documents on docusign.com. If you typed a password, call IT.28GuidesEmployee Offboarding Checklist: The IT Side, in Order
Offboarding IT in order: disable sign-in, revoke sessions, hand off mail and files, rotate shared passwords, recover the laptop, and write down what you did.29GuidesEDR vs Antivirus: What Your Cyber Insurance Form Is Really Asking
Antivirus matches files against known malware. EDR watches behavior, isolates an infected PC, and keeps a record. Insurers asking about EDR mean the second.30GuidesDFARS 7012 in Plain English: What 252.204-7012 Requires From a Small Defense Shop
DFARS 7012 requires NIST SP 800-171 on systems with covered defense information, incident reports to DoD within 72 hours, and 90 days of preserved images.31GuidesCMMC Level 2 Requirements: What a Small Manufacturer Has to Build
CMMC Level 2 means meeting all 110 NIST SP 800-171 Rev 2 requirements to protect CUI, with a score in SPRS, an SSP, and a yearly affirmation.32GuidesCMMC Level 1: What a Small Machine Shop Has to Prove to Keep DoD Work
CMMC Level 1 is an annual self-assessment against the 15 FAR 52.204-21 safeguards for FCI, affirmed in SPRS by a senior official. No third-party audit.33GuidesCMMC Enclave: How to Shrink Your Level 2 Scope to the Room Where CUI Lives
A CMMC enclave is a separated environment where CUI lives, so the rest of the business stays out of Level 2 scope. 32 CFR 170.19 sets how assets are scoped.34GuidesClickFix Fake CAPTCHA Malware: What to Do After "Verify You Are Human" Asks for Win+R
A ClickFix page fakes a CAPTCHA, copies a command, and says to paste it into Win+R. If someone ran it, unplug the PC, call IT, and reset passwords elsewhere.35GuidesBrowser Hijacker Removal: What to Do When Chrome or Edge Gets Taken Over
Reset the browser, remove extensions, uninstall the app that brought it, and check chrome://policy. If it says managed and shouldn't, or it comes back, call IT.36GuidesAkira Ransomware: What to Do in the First Hour, and How It Gets In
Hit by Akira? Disconnect affected machines, don't pay, keep the evidence, call IT and your insurer, and report to the FBI. Most Akira entries start at the VPN.37GuidesThe 3-2-1 Backup Rule: What Each Number Means and How to Test It
The 3-2-1 backup rule: keep 3 copies of your data, on 2 different media, with 1 copy offsite. CISA adds offline copies and tested restores.38GuidesWriting a WISP for a Tax Practice: What Goes In It
Every paid tax preparer needs a written information security plan under the FTC Safeguards Rule. IRS Pub 5708 is the official sample. Here's what goes in.39GuidesWhat Is OT Security? A Plant Manager's Version
OT security protects the computers and controllers that run physical equipment. The goal is keeping the line running and people safe, not just protecting data.40GuidesTennessee Insurance Agencies and the NAIC Data Security Model Law
Tennessee adopted the NAIC Data Security Model Law as the Insurance Data Security Law in 2021. Agencies under 25 people, $5M revenue, or $10M assets are exempt.41GuidesSwitching IT Providers: What the First 30 Days Should Look Like
Switching IT providers is mostly a handoff. Get admin access, documentation, and registrar logins from the old shop, then expect discovery and a baseline.42GuidesSeller Impersonation and Deed Fraud: What a Title Office Should Check
Seller impersonation fraud is someone posing as the owner of vacant or paid-off property to sell it. Title offices stop it by verifying sellers independently.43GuidesRegulation S-P Amendments: What an RIA Has to Have in Place Now
Amended Reg S-P requires a written incident response program, client notice within 30 days, and vendor oversight. Smaller RIAs had to comply by June 3, 2026.44GuidesWhat Counts as Nonpublic Personal Information in a Title File
Nonpublic personal information is personal financial data a consumer gives you or that comes from their transaction. In a title file, that's most of it.45GuidesHow to Verify Wire Instructions: A Callback Procedure for Title Companies
Call the payee at a number you had before the instructions arrived, never one from the email. Treat any emailed change as fraud until that call is done.46GuidesHIPAA Risk Assessment: What Your IT Has to Be Able to Show
A HIPAA risk assessment is required by the Security Rule. Your IT has to show where patient data lives, what protects it, and what is still exposed.47GuidesHIPAA-Compliant Email: What Actually Qualifies (and What Doesn't)
HIPAA-compliant email takes a signed BAA, enforced access controls, audit logs, and documented encryption. Microsoft 365 and Gmail qualify once set up.48GuidesThe GLBA Safeguards Rule in Plain English for Small Firms
The GLBA Safeguards Rule requires mortgage brokers, tax preparers, and similar firms to keep a written nine-element security program and report breaches.49GuidesBusiness Email Compromise: How It Actually Happens at a Small Firm
Business email compromise is when a criminal uses a real or faked business inbox to redirect a payment. Phone verification and enforced MFA stop most of it.50GuidesALTA Best Practices: What the IT and Security Pillars Actually Ask For
ALTA Best Practices is a voluntary seven-pillar framework for title companies. Pillars 2 and 3 cover wire procedures and the WISP, and IT owns the proof.51GuidesABA Formal Opinion 477R for Small Firms, in Plain English
ABA Formal Opinion 477R says you may email clients if you've made reasonable efforts to secure it. Here is what that means in actual IT controls.52SecurityWordPress CVE-2026-87902: Unauthenticated Path Traversal Under Active Attack
CVE-2026-87902 lets an unauthenticated attacker make WordPress 4.7.0 through 7.1.1 include a PHP file outside the theme folder, and on some servers that becomes remote code execution. Update to 7.1.2 or your branch's backport now; it's being exploited.53GuidesThe Best 5 Knoxville IT Companies
The best 5 Knoxville IT companies for managed IT. Limehawk for regulated firms of 5-100. TenHats, The IT Company, Hyperion, and TeamLogic are strong shops.54SecurityOpen RDP on the Public Internet: Found During Onboarding Discovery
Day-one discovery for a new client found Remote Desktop exposed to the public internet. Nothing was breached yet; we closed it before someone found it.55SoftwareWebView2 Runtime Won't Install? The Admin MSI Fix That Actually Works
A user's app wouldn't launch because WebView2 Runtime silently failed to install. The fix was to grab the MSI directly from Microsoft and install it elevated.56SecurityGetting Verification Codes You Didn't Request? How to Tell Spam From Account Compromise
A title company user received back-to-back OTP codes she never asked for. The triage playbook: attacker on a signup form versus actual account compromise.57SecurityFinding Your BitLocker Recovery Key After a Windows Update Breaks Boot
How to find your BitLocker recovery key after a Windows update breaks boot: Microsoft account, Entra, or the copy your IT team escrowed. There is no bypass.58SoftwareQuickBooks Desktop Hangs on Intuit ID Login: The Send Forms Workaround
QuickBooks Desktop couldn't email invoices. The Intuit ID login window hung forever. The fix wasn't a password.59SecurityBEC Wire Fraud at a Title Company: How We Stopped a High-Six-Figure Loss
An attacker got into a closer's inbox and sent fraudulent wire instructions to the other side of a real estate deal. We contained it in under three hours.60AutomationAutomating CrushFTP Upgrades and In-Place Updates
Shell scripts for major version upgrades and minor updates. Transform a complex manual process into a single, reliable command.61SoftwareFront App Keeps Sending Emails to Spam: Why Whitelisting in Front Doesn't Work
Wire confirmations kept landing in Front's Spam folder. Not Spam clears one message; the durable allow list lives in Gmail, where classification happens.62InfrastructureAT&T Fiber Keeps Dropping? How We Proved the ISP Was the Problem
An insurance agency's remote desktop kept reconnecting all day. AT&T blamed our equipment. External ping monitors proved them wrong.63InfrastructureAutomated Proxmox Host Configuration Backups to SMB Share
Deployed automated monthly backup solution for Proxmox VE host configurations using bash script and cron.monthly.64InfrastructureAutomating Wildcard SSL Certificates on Synology NAS with acme.sh
How to run acme.sh on a Synology NAS: wildcard Let's Encrypt via Cloudflare DNS-01, then the synology_dsm hook so certs survive DSM updates.65InfrastructureLenovo ThinkBook Camera Stuck in DFU Mode After Update
A Camera DFU Device in Device Manager means the webcam is stuck in firmware update mode, usually after a Windows update. Here is the remote fix.66AutomationPC Replacement: Zero Data Loss User Profile Migration
CFO's laptop dying, needed everything moved to new machine. 47GB of documents, app settings, and browser data migrated in 90 minutes with USMT.67InfrastructureMac Running Slow: Disk Errors Causing Performance Issues
Designer's MacBook Pro crawling during large file operations. Disk Utility showed nothing. Deep scan found filesystem inconsistencies across 3 volumes.68AutomationWinget for RMM: Silent Software Deployment at Scale
85 machines needed 15 applications each. Manual install: 64 hours. With winget automation: 3 hours. Plus weekly auto-updates.69SoftwarePrint to PDF Not Working in Citrix: Remote Application Printing Fix
Citrix printer redirection not working, or Print to PDF does nothing? Microsoft Print to PDF is not a redirectable driver. Install PDF24 on the local PC.70SecurityOneStart Browser Hijacker: Complete Removal from 30 Infected Machines
How to uninstall OneStart: the Windows uninstaller leaves scheduled tasks that put it back. Kill the processes, delete the tasks, then wipe the files.71SecurityLaptop Stolen at Airport: Emergency Remote Wipe via RMM
Friday 4:47 PM. Sales rep's laptop stolen with customer data. Device online on a different network. We had minutes to act.72AutomationMass BIOS & Driver Updates: Dell Fleet Vulnerability Patching
Critical BIOS vulnerability affecting 127 Dell machines. Manual updates would take weeks. Dell Command Update via RMM: 2 weeks, zero site visits.73AutomationFixing Windows Time Sync: Clock Wrong, Can't Log In
Law firm paralegal locked out Monday morning. Clock showing March 2019. Kerberos won't authenticate with 5+ minute time drift.74AutomationFixing Windows Update Stuck in Reboot Loop: Nuclear Reset
HR laptop cycling 'Undoing changes' for 6 hours. 24H2 update failing at 47%. Benefits deadline in 3 hours. Standard fixes failed.75SecurityLocked Out of Client PC: Emergency Local Admin via RMM
IT director quit and changed every admin password on the way out. Domain locked, DSRM locked, 85 users dead in the water. RMM saved the day.76AutomationServer at 99% Disk: Recovering 47GB Windows Couldn't Clean
Application server at 0.7% free space. Standard Disk Cleanup found 400MB. We found 47GB hiding in WinSxS and SoftwareDistribution.77AutomationAfter-Hours Patching Failed: Machines Asleep During Maintenance
Scheduled overnight patches couldn't run - 60% of workstations were powered off or sleeping. Enabled Wake-on-LAN across Dell, HP, and Lenovo fleet.78AutomationServer Going to Sleep: Critical Operations Interrupted
Digital signage kiosk kept going dark during business hours. Windows power settings were reverting after every reboot. Fixed with enforced always-on profile.79AutomationBitLocker Encryption at Scale: Compliance in 72 Hours
Cyber insurance required full-disk encryption on 127 endpoints. Manual BitLocker is 15 minutes a machine; we automated it zero-touch with escrowed keys.80SecuritySecurity Audit: Passwords Found in Spreadsheets and Documents
Compliance audit required proving no plaintext passwords on endpoints. Scan found 23 files with 'password' in the name containing actual credentials.81AutomationFixing Windows Corruption After Malware: DISM and SFC Repair
Malware removed but laptop still broken. Settings won't open, search returns nothing, Explorer crashing. 847 corrupted components.82AutomationComputer Running Slow? Finding What's Using Your Disk Space
'My computer is slow' ticket. 2GB free on 256GB drive. We found 90GB of recoverable space in 43 seconds without interrupting the user.83AutomationApp Can't Connect: Firewall Blocking Production Software
New accounting software couldn't reach its license server. Quick firewall toggle isolated the issue in 30 seconds instead of hours of port hunting.84AutomationISP Blaming User Equipment: Automated Speedtest Evidence
The ISP said 'your equipment is the problem.' Automated speedtests across 47 endpoints proved throttling and got the circuit fixed.85AutomationShared PC Out of Disk: Stale User Profiles Eating Storage
Training room PC down to 2GB free. Windows Disk Cleanup found nothing. 47 old user profiles from past employees consuming 180GB.86AutomationLost Wi-Fi Passwords: Bulk Recovery from Existing Devices
Office move, IT person quit, no documentation. 23 SSIDs saved on machines but nobody knew the passwords. Extracted all credentials in 12 minutes.87AutomationPatch Compliance Failing: 90+ Day Uptime, Missing Updates
Audit flagged 49% of endpoints missing critical patches. Updates were installed - just waiting for reboots that never came.88AutomationInsurance Audit Hardware Inventory: 312 Assets in 47 Minutes
Cyber insurance required a complete hardware inventory: serials, specs, encryption status. Manual audit quote: 2 weeks. Automation delivered it same day.89AutomationPrint Spooler Stuck: Clearing Hundreds of Jammed Print Jobs
Accounting firm, April 14th. Every printer offline, 847 jobs stuck. They'd tried everything for 2 days. We fixed it in 90 seconds.90AutomationFixing KB5034441 Error 0x80070643: WinRE Partition Resize
312 machines failing the same update after Patch Tuesday. Microsoft's fix was 15 manual steps per machine. We automated it.No reports match that. Try fewer words, or ask us.
Advertisement, ours, permanently
Recognize your problem in this list?
Every one of these was an urgent morning for somebody. Book fifteen minutes with Corey before yours.