I sat down with a small Northland engineering firm this week. About six weeks ago someone got into one of their staff mailboxes. They think it started with a dodgy click.

The attacker used that mailbox to send fake copies of the firm’s end-of-month statements to their customers. Some of them were five figures.

The attacker also set up inbox rules so any reply to those emails never reached the firm. Customers wrote back more than once & nobody in the office saw it. They found out when a customer rang to say “I think you’ve been hacked. We’ve been sent this invoice.”

Most of their customers were onto it and nobody paid. The office still lost a couple of hours going back through everyone they’d invoiced that month, resending the real invoices with a note, and ringing people.

Their IT provider came in, reset the password and found & removed the attacker’s inbox rules. Then they left.

No security was added. Nobody told the firm what should change. When we looked at their Microsoft 365 licences together this week, six weeks on, they were still on Business Standard (which can’t block an overseas login without a paid add-on) and nothing was watching for new inbox rules. If it happened again tomorrow, nothing in place would stop the sign-in or flag the rules, and they’d find out the same way – a customer on the phone.

That’s not good enough. Cleaning up after an attacker is half the job. The other half is making sure the next one can’t do the same thing, and a small business deserves that as much as a big one.

What a proper clean-up covers

A reset stops the attacker signing in with the old password. Microsoft’s own guide for a compromised mailbox has it as one step of several:

• Sign the attacker out everywhere. Some sessions can survive a password reset until someone revokes them.
• Delete their inbox rules & any forwarding to outside addresses. Rules sit on the mailbox, so they keep running whatever the password is.
• Check the MFA (multi-factor authentication) methods on the account. Attackers often add their own phone so they can approve their own sign-ins.
• Remove any app nobody recognises that has been given access to the mailbox.

Then someone should go through the sign-in & mailbox logs to see what else was opened while they were in.

That’s the clean-up. The fixes below are what stops the next one, and none of them are only for big companies.

What we’d put in place

Turn on MFA for every account first. That works on any Microsoft 365 plan.

Then move to Business Premium. Business Standard doesn’t include Conditional Access (the rules that decide who can sign in & from where) unless you buy it as an add-on. Premium has it built in. If your business sends invoices by email, you should be on Premium.

With that in place you can block sign-ins from outside New Zealand. Roughly 1 in 3 identity attacks Huntress investigates comes from a location or network the business had no reason to allow – geo-blocking stops those before the password is even tested. When someone travels, you add an exception for the trip.

The last piece is watching inbox rules. We use Huntress ITDR (identity threat detection & response), and their security team audits every new rule that gets created. Most are harmless. When one shifts mail into a folder nobody opens, like RSS Feeds, they lock the account so it can’t send any more email until it’s been sorted.

The cheapest control

If a supplier tells you their bank account has changed, pick up the phone and ring them on the number you already have. Don’t reply to the email, because the attacker may be reading it. We ask every client to set this up as an invoice fraud policy.

Ask your IT provider

If you’ve had a compromise, ask your IT provider what the attacker did while they were in, and what’s changed so it can’t happen the same way again. If the answer to the second one is “nothing”, give me a call on 09 222 7770 or have a look at our security & protection services.

Not sure where your business stands? Try the free Cyber Readiness Self-Check.

Microsoft’s Copilot Cowork bills by usage – you pay for every bit you use. Handy, right up until it’s running in the background & nobody’s watching the meter.

What happened

One client was capped at 30,000 Copilot credits for the month. A couple of days before month-end they’d nearly run it out – mid-job, needed to finish – so they rang & asked us to bump the cap to 40,000.

We bumped it. Done. No surprise bill – they just made a call, knowing exactly where they stood.

Why we cap every client

I won’t put a pay-by-usage AI tool in front of a client without a cap on it.

Rough costing: Microsoft bills Copilot at about US$0.01 per credit on pay-as-you-go, so a 30,000-credit month is around US$300 (about NZ$520).

Copilot Cowork calls them credits, not tokens. If you’re thinking in tokens: Microsoft charges 10 credits per 1,000 tokens, so 1 token is 0.01 credits.

Our advice

Running Copilot Cowork, or anything that bills by usage? Put a budget on it from day one. And whichever AI tool you use, make it a paid business version – free ChatGPT is no place for client data.

Want a hand setting one up? Have a look at how we help with AI or get in touch – nice and simple.

He’d been proudly running every customer contract through it to review them. Saving hours, loving it. Fair enough – it’s a brilliant tool.

But there’s an old rule that still holds. If you don’t pay for the product – you’re the product.

Where the contracts went

On the free version, whatever you paste in can be used to train the model. So every contract – client names, prices, the confidential bits – had left his business and landed in a system he doesn’t own and can’t pull back.

No hacker. No breach. He handed it over himself, chuffed to be saving a few bucks.

Keep using AI, just use the right version

I’m not telling anyone to stop using AI. Use a paid business version where your data stays yours & isn’t fed into training, and give your team a simple rule on what’s safe to paste.

Doing something clever with AI? Just check which version you’re on first. And if it bills by usage, like Copilot Cowork, set a spending cap from day one.

Happy to show you what safe looks like – see how we help businesses use AI or give us a shout.

I see this most weeks.

Why the box stays half unpacked

Business Premium is about a dozen products behind one price.

You get sold it for email. Email works on day one, so the rest sits there. Nobody’s job is to go back six months later and ask what else came with it.

So businesses go out and buy things they’ve already got.

The five I find most often

• Intune (device management). Wipe a stolen laptop remotely. Push settings to every machine at once. A new PC configures itself when the staff member logs in. This is the one people pay twice for.
• Conditional Access. MFA (multi-factor authentication) is the lock on the front door. Conditional Access is the rule about who gets to knock – block sign-ins from outside New Zealand, or from a device you don’t manage. Microsoft switches on a couple of basic policies these days. Almost nobody tunes the rest.
• Defender for Office 365. Sandboxes attachments before they land & re-checks links at the moment someone clicks. Most invoice fraud we see comes through a link that was clean on delivery and weaponised an hour later.
• OneDrive Known Folder Move. Desktop, Documents & Pictures go to the cloud automatically. Staff don’t have to remember anything. It isn’t proper backup, but it stops the everyday disasters.
• Bookings & Planner. Already paid for. I still see businesses running separate subscriptions for both.

Where the money gets wasted

Business Premium also includes Defender for Business – EDR (endpoint detection & response) on every machine.

Bolting a third-party antivirus on top of that is money down the drain. You’re paying twice for the same job.

Defender finds plenty. The catch is that the alerts land in a console nobody opens at 2am.

So the add-on worth paying for isn’t another product – it’s a SOC (security operations centre). A team watching those alerts around the clock and acting on them. Ours went through 351 million security events last year to surface 30 real incidents. Those 30 are the ones that would have ruined somebody’s month.

Cut the duplicate antivirus, put the money into someone actually watching. That trade is worth making.

The same goes for the newer pay-as-you-go extras like Copilot Cowork – put a spending cap on Copilot before anyone switches it on.

Secure Score

Microsoft gives every tenant a Secure Score – a live measure of how locked down your Microsoft 365 is. MFA coverage, admin protection, mail rules, device policy.

We hold every managed client above 70%. Most tenants we see for the first time sit well below it, and almost none of the gap costs anything to close. It’s configuration that came with the licence.

Same ground SMB1001 Gold covers – 27 controls, checked by an outside body rather than self-declared. We went through it ourselves before asking a client to.

Three questions for whoever manages your tenant

“What’s my Secure Score, and what were the last three things you changed to move it?” Someone managing it properly answers both halves in a minute.

“What am I paying for separately that’s already in my licence?” Ask for the list.

“Which licence are we on?” Basic, Standard & Premium are very different animals. Basic is fine for someone who only ever picks up email on their phone. Standard is where people get caught – it reads like the sensible middle option, and it’s missing Intune, Conditional Access & Defender for Office 365. Every one of the features that actually matters. Plenty of businesses have sat on Standard for years without knowing it.

Next step

Take the free 2-minute Cyber Readiness Check – it walks you through the gaps most Northland businesses have.

Or if you’d rather someone just looked at your tenant and told you what’s paid for and switched off, see what managed IT support covers or give us a ring on 09 222 7770.

Nice and simple.

You don’t need your password stolen to get hacked.

You click a link that looks legit, sign in like you always do – and in the background they grab your session cookie. That’s the little pass your browser holds that says “this person’s already logged in.”

With that cookie they don’t need your password. They don’t need your MFA (multi-factor authentication) code either. They’re just in – as you.

No alarm. Nothing looks wrong.

And a password reset on its own won’t always shut them out – what a proper clean-up after a hacked mailbox covers.

So what’s the real question?

It isn’t “have I got MFA”.

It’s “if someone slips past it, who’s watching to kick them back out?”

That’s the bit most small businesses are missing. Something watching for the dodgy login & shutting it down before any damage is done.

We use Huntress ITDR (identity threat detection & response) for exactly this. It has caught this attack on a client and had it sorted in minutes – the customer had no idea anything had happened until we called.

Got MFA but nothing watching behind it?

That’s the gap. Happy to take a quick no-jargon look.

Give us a ring on 09 222 7770, or take the free 2-minute cyber readiness check and see where you stand.

His email? Running in an old program on his computer. The mailbox itself hosted by the same company that built his website. Backups done by hand, when he remembers. No second layer of security. No cyber insurance.

I asked him about it. His answer was the one I hear most: “I’ve never had a breach, so I’ve always sort of trusted it.”

That’s the bit that worries me. Let me explain why – in plain English.

What “email on your computer” actually means

The old way of doing email – POP3 (Post Office Protocol) – pulls your messages down onto one machine and leaves the only real copy sitting on that hard drive. Not in the cloud. On the computer under the desk.

Back when you had one PC and one job on the go, fine. But today that setup is carrying three risks at once, and most owners have never been told about any of them.

Risk one – the hard drive is the only copy. Modern drives are soldered-in chips now. No moving parts, nothing to recover. When one dies – and they do – manual backups are only as good as the last time you actually did one. Miss a fortnight, lose a fortnight. Everything.

Risk two – one password is the whole lock. No multi-factor authentication (that second code on your phone). So if someone guesses or steals the password to your web host, they’re straight into your email. No alarm. Nobody gets told.

Risk three – this is the one that costs real money. If a scammer gets into your email, they sit and watch. Then they wait for a big invoice to go out – and quietly change the bank account number on it before your client pays. You’ve done nothing wrong. The client pays the wrong account. On a $200k invoice, that’s not a computer problem – that’s a house deposit gone. Once they’re in, a password reset alone won’t stop them coming back.

“But nobody bothers a business my size”

That logic flipped years ago.

It used to be you were too small to be worth a hacker’s time. Now it’s the opposite – you’re the easy one. You haven’t spent what the big guys spend on security, so you’re the cheaper door to kick in. It’s the smaller businesses getting hit these days, precisely because they think they’re too small to be a target.

And it’s not always your email they come through. I’ve watched website hosts themselves get compromised – the attacker gets in once, then pushes malware out through every customer site they host. One local outfit got done and it flowed straight through to their customers’ sites. The sites still looked completely normal. That’s the whole trick.

The good news – none of this is dramatic to fix

You don’t rip everything out. You move email off the web host and into a proper cloud platform like Microsoft 365, set up properly:

• Your mail lives in one place and syncs across every device – laptop, phone, ute – always current.
• MFA on by default, with threat protection watching for the dodgy stuff.
• Real backup and recovery, so a dead hard drive is a shrug, not a disaster.
• And your email separated from your website – two different jobs, two different homes. One has a bad day, the other keeps running.

And get cyber insurance while you’re at it. A professional firm I know got hit for $700,000. Their insurance covered it – without it, that was the whole business gone. Cover costs a lot less than most owners expect – and next to nothing against what one intercepted invoice would set you back. That’s the maths.

The bottom line

“It’s never been hacked” isn’t a security plan – it’s a run of good luck you can’t see the end of. If your email still lives on your computer, hosted by your website company, with manual backups and one password protecting it, you’re carrying a risk nobody’s put a number on for you.

Here’s the easy first step. We’ve put a free two-minute cyber readiness check online – plain-English questions about your email, your files, your backups and your website, and a straight score at the end. No cost, no obligation. You’ll simply know where you stand.

If you’d rather we just took a look ourselves, give us a ring on 09 222 7770. We’ll tell you straight.

What they now expect before they’ll cover you

• MFA on everything – email, remote access, admin logins. Miss it and a claim can be declined outright.
• EDR (Endpoint Detection & Response) – proper monitoring, not just antivirus.
• Backups that are tested & offline, so ransomware can’t reach them.
• Staff trained to spot a phishing email.
• An incident response plan you’ve actually read.

The nasty bit

You can hold a policy, get hacked, and still have the claim knocked back because one box wasn’t ticked.

Insured on paper. Uninsurable in practice.

A proposal form is a declaration – you’re telling the insurer how the business actually runs, and they underwrite on the strength of it. When something happens, the investigation includes whether the controls you declared were really in place on the day.

Most people aren’t lying. They tick yes because they believe MFA is on, or that the backups get tested, because someone said so a few years back. Nobody has looked since.

What to do about it

We help Northland businesses get these controls in place & documented – so when you tick the box, it’s true. That’s the same ground SMB1001 Gold covers: 27 controls, checked by an outside body rather than self-declared.

There’s more detail on what each question means and what the evidence looks like on our cyber insurance compliance page.

Renewal coming up? Send it my way before you sign – let’s make sure you’re actually covered. Give us a ring on 09 222 7770, or take the free 2-minute readiness check first.

Nearly every time we take on a new business in Northland we find something nobody knew was running. An old server in a cupboard still holding staff records. A machine nobody had patched in over a year. A mailbox rule quietly moving invoices out of sight.

None of it was anyone’s fault. It just never got looked at, because the old arrangement was reactive — you rang when something broke, they fixed the thing that broke, and everything else stayed invisible.

That is the real thing you are buying when you hire an IT company properly. Not faster fixes. Someone looking before it breaks.

Most people hiring an IT company have done this at least once before and it did not go brilliantly, so here is what the first ninety days should actually look like.

Week one should be an audit, not a rescue

If a new provider opens by selling you hardware, be careful. The first fortnight should go on finding out what you actually have — every device, every user account, every licence you are paying for, and every system still running that nobody remembers.

We put every client machine into one monitoring system so the whole lot is visible in one place. Across our client base that is over a thousand devices. The value is not the number, it is that nothing is hiding — and nothing hidden means nothing that jumps out at you later, including the bill.

Expect a lot of questions in week one. Expect the answers to surprise you a bit.

You should get a list, not a lecture

At the end of that audit you should get something short and readable. A plain list of what is wrong, ranked by what matters, with the cost to fix it and what happens if you leave it.

Not a fat PDF nobody opens. Not a presentation full of red dials designed to frighten you into signing something bigger. A list.

Most owners find that list shorter than they feared. The stressful part was never the list — it was not knowing.

The handover from your old provider is the risky bit

This is where switching providers actually goes wrong, and it is worth knowing before you start.

The danger is not the technology. It is the keys. Domain names, Microsoft 365 admin access, the login for your website, the account with your internet provider — these are often sitting in an old provider’s name rather than yours. If nobody chases them down properly you can end up locked out of your own systems months later, usually at the worst possible moment.

A good provider maps all of that before anything moves, gets ownership transferred into your business name, and does the cutover outside your working hours. Ask specifically how they handle it. If the answer is casual, that is your warning.

Owning it and hosting it are two different things. Your domain name belongs to you. So does your Microsoft tenancy and your data. That does not change when you hire someone.

What we do take over is the hosting of the domain — the DNS records that point your website and your email at the right place. You still own the name. We just hold the controls and make the changes.

That is deliberate. Those records are the one place where a single wrong entry takes down your website and your email at the same time, and it is almost always someone changing a setting in good faith who does it. Keeping them in one set of hands means nobody wipes it out by accident.

So ask any provider two questions: who owns the domain, and who touches the records. The answers should be you, and them.

What you are actually paying for each month

The monthly fee confuses people, so here is the honest version. You are paying for three different things bundled together:

• The help desk — someone answers when a staff member cannot print.
• The watching — patching, backups, monitoring, security alerts. The work you never see and only notice when it stops.
• The thinking — someone who knows your business well enough to tell you what is coming in eighteen months.

In our experience the cheap quotes have usually dropped the second and third one. That is why they are cheap. It is not a rip-off, but you should know which you are buying, because the watching is the part that stops the expensive incidents.

Ask for the price per user per month, ask exactly what sits inside it, and ask what falls outside it and gets billed hourly. A straight answer to that third question tells you most of what you need to know about a provider.

Local matters — but not for the reason you think

People assume local means someone can drive out when a machine dies. That is real, and it counts. But honestly, most of what we do gets done remotely and faster than anyone could drive.

The real value of local is understanding what your business actually looks like. A transport yard in Whangārei with drivers on phones all day has different problems to a professional services office with everyone on a laptop. Someone who knows the region and the industry asks better questions — and asks them before they sell you anything.

So ask who else in your industry they look after. Ask for a name you can ring.

Three questions worth asking before you sign

• “If someone was sitting in our email right now, how would you know?” Not which tools they sell — who actually reads the alerts, and how quickly you would hear about it. Tools nobody is watching are decoration.
• “What happens in the first ninety days, week by week?” A provider who has done this properly will have a straight answer. One who has not will talk in general terms about partnership.
• “If we leave in two years, what do we walk away with?” The answer should be everything, without a fight. Ask it early, while they still want your business.

Where to start

You do not need to commit to anything to find out where you stand. The most useful first step is the smallest one — an honest look at what you have running today.

We have made that easy: a free Cyber Readiness Self-Check you can run yourself in a couple of minutes. It runs you against SMB1001 — a tiered cyber-security standard built for small and medium businesses — and hands back your gaps in plain English. Free, and nobody rings you afterwards.

If you want the longer version of how to weigh providers up, we have written it out here: How to choose an IT provider in Northland.

Or just give us a call on 09 222 7770. We will start with the small version, not the big one.

Not a gut feeling. Proof.

27 controls, checked one at a time

So we ran the business through SMB1001 Gold – the NZ small-business cyber standard. 27 controls, checked one at a time:

• Multi-factor login (a code on your phone) on every account
• Encrypted laptops
• Machines kept patched
• Backups you can actually restore
• Staff trained to spot a dodgy email

The policy nobody expects

Part of it is having the right policies in place – including one on how your team can use AI.

When I showed him that one, he volunteered he’d spent the week pasting his contracts into the free version of ChatGPT – which can use whatever you type to train the model. His confidential wording, out the door.

That’s the whole game for us. Know IT & Prove IT.

Gold was one of the things we put in front of the judges when IT Live Northland made the final for Best Emerging Business at the 2026 Northland Business Excellence Awards.

Would your business pass?

If you’ve ever wondered whether your business would pass – or you just want to know where your gaps are – let’s have a chat. Nice and simple.

Take the free SMB1001 cyber readiness self-check, or get in touch and we’ll walk you through it.

Here’s what’s changed – and why “we’re too small to be a target” is the myth that quietly empties bank accounts in Northland.

A virus breaks your computer. It’s loud, it’s obvious, you know something’s wrong. But your identity – your email login – is worth far more to them. Because with it, they don’t break anything. They just become you.

How it plays out

They get into an email account – usually a stolen password, or a login someone got tricked into handing over. Then they go quiet. They sit there for a week or two and read your emails. They learn how you invoice, who pays you & what your invoices look like. Often they set up inbox rules so your customers’ replies never reach you – here’s what that looked like for one Northland firm.

Then they send a real invoice – from your actual account, in your name, to your actual customer – with one thing changed. Their bank account number.

Your customer has no reason to blink. It’s your email. Your usual amount. So they pay it. The money’s gone before anyone notices – and these hit for tens, sometimes hundreds of thousands.

No virus. No alarm. Nothing “broke”. That’s exactly why it works – and why old-school antivirus never sees it.

The rule that stops it

Now the good news. You don’t stop this with fancy tech. You stop it with a simple rule everyone follows.

It’s actually one of the checks to earn SMB1001 Gold (a cyber security certification) – and yes, we run it on ourselves. In plain English:

• Any request to change a supplier’s bank details gets treated as high risk – full stop.
• A second person checks it – not the one who got the request.
• You ring the supplier to confirm – on a number you already had, NOT the one in the email or on the invoice.
• You write down the call (who you spoke to, when, what number), and the finance lead signs it off before anything changes.

And the golden rule – you NEVER change a bank account off an email alone. Even if it looks exactly like it came from someone you know.

Then back the habit up with the tech

• Multi-factor authentication on every account (a code on your phone) – so a stolen password on its own is useless.
• A conditional access policy that blocks logins from overseas. Most Northland businesses only ever log in from… Northland. Roughly 1 in 3 identity attacks Huntress investigates comes from a location or network the business had no reason to allow – geo-blocking stops those before the password is even tested.

Do those three things and this whole scam falls over.

We don’t take ourselves too seriously – but we’re deadly serious about protecting your data.

Want to see how you’d score?

Take our free SMB1001 cyber readiness self-check, or get in touch & we’ll send you the exact invoice policy we use – nice and simple.