Welcome to The CIC Brief. Once a month we’ll pull together the security news that actually matters for a business your size, what it means for you, and what (if anything) to do about it. October is Cybersecurity Awareness Month, so it’s a good moment to take stock. Five minutes, no jargon.
This is the full breakdown of this month’s CIC Brief. Jump to: the news · your industry · scam of the month · AI corner.
Three stories worth knowing
Microsoft’s biggest update ever, with two flaws already in use
Microsoft’s September updates fixed nearly 1,000 security flaws across Windows and its other products, a record. Two of them were already being used by attackers. Both let someone who has a foothold on a PC, say through a phishing click, take full control of it.
Does this affect you? Yes, if your team uses Windows. Flaws like these are how one bad click turns into a fully compromised computer.
What to do: Check that every PC has installed September’s updates and restarted. October’s updates come out today, so check again later this week.
Apple’s emergency iPhone, iPad and Mac fix
On September 28, Apple released emergency updates to fix a flaw that had been used in what it called an “extremely sophisticated attack” against specific people. Opening a booby-trapped image or file was enough to let an attacker run code on the device.
Does this affect you? You’re unlikely to be a target of this exact attack. But once a fix is public, copycats study it, so older devices become easier to attack.
What to do: On iPhones and iPads: Settings → General → Software Update. On Macs: System Settings → General → Software Update. Install what’s offered and turn on automatic updates.
See Apple’s security updates →
Close to home · Utah
Eagle Mountain knocked offline by a cyberattack
Starting September 17, a distributed denial-of-service (DDoS) attack, which floods a network with junk traffic, caused slowdowns and outages for Direct Communications internet customers across Eagle Mountain. City Hall and the library closed, and service was restored on Monday, September 21.
Does this affect you? If your business runs on one internet connection, an outage you can’t control can stop phones, card payments and cloud apps for days, even though nothing on your end was hacked.
What to do: Have a backup for essential work, such as a phone hotspot or a second internet line, and make sure key staff can reach email and files from their phones if the office connection goes down.
What’s new in your industry
Healthcare & Dental
The big HIPAA Security Rule overhaul won’t land this year: HHS now expects final action around July 2027. In the meantime, the Office for Civil Rights is still enforcing today’s rules, starting with a documented risk analysis. The proposed rule would require multi-factor sign-in and encryption everywhere. Both are inexpensive to turn on now, so doing it early puts you ahead either way.
Where we can help: Turning on multi-factor sign-in and encryption in the Microsoft 365 or Google Workspace you already pay for, and documenting a risk analysis, are things we help practices with. Our security assessment →
Where the HIPAA update stands →
Cybersecurity for dental & healthcare practices →
Legal & Professional Services
As more firms try AI tools, the ABA’s guidance still applies. Formal Opinion 512 says lawyers must understand how an AI tool handles client information, and may need a client’s informed consent before entering confidential details into a tool that learns from what you type. Stick to firm-approved AI accounts. And as always, confirm any change to wiring instructions by calling a number you already have on file.
A plain summary of Opinion 512 →
Cybersecurity for law & professional-services firms →
Financial Advisors
If you’re an SEC-registered adviser with under $1.5 billion in assets, the amended Regulation S-P rules have applied since June 3. You need a written incident response plan, a process to notify affected clients within 30 days of a breach involving their sensitive information, and oversight of vendors who handle client data. The SEC has said it will be checking this in exams.
Where we can help: Writing the incident response plan and client-notification process, and reviewing the vendors who handle client data, is work we do with advisory firms. Our security assessment →
Cybersecurity for financial advisory firms →
Scam of the month: The “Allow” button that skips your password
On September 1 the FBI warned about “consent phishing”: tricking people into giving a malicious app access to their email and files. It works even if you use a strong password and two-factor sign-in. Feel free to share this section with your team.
From: Dana Whitfield, Events <dana@example.com>
Subject: Speaker invitation: Small Business Leaders Roundtable
“We’d love to have you on our October panel. Please review the event brief and confirm your spot here: View document.” The link opens a real Microsoft or Google screen: “Event Brief Viewer wants to read, send and delete your email and access your files. Allow / Cancel.”
The warning signs
- An unexpected invitation or request from someone you don’t know. The FBI says attackers pose as event planners, journalists, officials and colleagues.
- Opening a document should never require letting an app read and send your email. If the permission list asks for more than the task needs, stop.
- The screen looks legitimate because it is: it’s the real Microsoft or Google permission page. What matters is the app you’d be approving, not the page it’s shown on.
If you get one: Click Cancel. If you already clicked Allow, changing your password won’t fix it: the app keeps its access until it’s removed. Google accounts: myaccount.google.com/permissions. Personal Microsoft accounts: account.live.com/consent/Manage. Work Microsoft 365 or Google Workspace accounts: tell whoever manages IT, who can remove the app for everyone and require admin approval for new apps.
AI corner: Personal AI accounts are the new shadow IT
Verizon’s 2026 report found that two-thirds of people using AI tools on work devices do it with personal accounts rather than company ones. That matters because business versions of ChatGPT, Microsoft Copilot and Gemini generally keep your data out of model training, while free personal accounts often don’t unless someone changes a setting. A simple rule for your team: use the company-approved AI account for work, and never paste passwords, client or patient details, or financial records into a personal one.
Where we can help: We help businesses see which AI tools their team is already using and put a simple, sensible AI use policy in place. The quarterly security partnership →
More on what the 2026 report found →
Get The CIC Brief in your inbox. A one-minute email once a month: 3 things that happened, 2 quick wins and 1 question for your team. Subscribe →
Want to know where you stand?
Our assessment scores your business against 36 security controls and ends with a plain-English plan, most of it fixed with tools you already pay for. Tell us about your business — or call (949) 802-4831.