#security
Security
Protect your financial data with security best practices and tools
Cloudflare's Pay Per Crawl Deadline: What Small Business Website Owners Need to Know Before September 15, 2026
Starting September 15, 2026, Cloudflare will block mixed-use AI crawlers by default on ad-carrying pages for free-tier and new accounts, part of a broader shift from Pay Per Crawl to a Pay Per Use monetization model that lets site owners charge AI companies when content actually creates value.
Expensify's MCP Server: What Connecting an AI Assistant to Your Books Actually Means
Expensify launched an MCP server on June 8, 2026, letting Claude, ChatGPT, and Cursor query live expense data via OAuth 2.1. Here is what Model Context Protocol means for small business books, which access questions to check before connecting — read-only vs. write, revocability, data retention — and why clean records matter more in the AI era.
AI-Powered Fraud Detection for Small Businesses: Real-Time Auditing Without a Big-Four Budget
Business email compromise cost U.S. companies over $3 billion in 2025, averaging $137,000 per incident — and 45% of small businesses hit by BEC close within six months. AI-driven continuous auditing now starts around $20–$70/month; here's how anomaly detection, vendor account validation, and free controls like payment-change callbacks cut the risk without an enterprise fraud stack.
Cyber Insurance for Small Businesses: The Coverage Gaps That Blindside Owners
Only 38% of small businesses carry cyber insurance, 44% of insured ones are underinsured, and nearly half of claims are denied or closed without payment. A guide to the ransomware sublimits, social engineering caps, and security-control requirements that determine whether a policy actually pays.
Cyber Insurance for Small Businesses in 2026: What It Costs, What It Covers, and Where Claims Get Denied
Small business cyber insurance runs roughly $400–$1,600 a year for a $1 million limit, while the average breach recovery costs $120,000 and downtime $53,000 an hour. A guide to first-party vs. third-party coverage, 2026 premium drivers, and the social-engineering sublimits and MFA requirements that most often sink claims.
AI-Generated Fake Invoices Are Fooling Accounts Payable Teams — Here's How to Stop Them
Generative AI made vendor impersonation cheap: 76% of organizations faced payments fraud in 2025, and AI-generated fakes now drive 70.8% of expense-report fraud. Here are the controls that still work — out-of-band verification, dual authorization, vendor-file hygiene, and auditable books.
IRS Dirty Dozen 2026: How Payroll Phishing and Direct-Deposit Scams Target Small Businesses
The IRS's 2026 Dirty Dozen list flags a payroll-specific phishing wave: fake HR portal emails and direct-deposit change requests that reroute paychecks to scammers. The FBI's IC3 logged 24,768 business email compromise complaints totaling roughly $3.05 billion in 2025, with 86% of losses moving by wire or ACH — the same rails payroll runs on. Here are the three warning signs (urgency, unusual requests, process changes), five process controls that close the email-only loophole, and the first-72-hours response if a paycheck has already been diverted.
Missouri's HB 974 Insurance Data Security Law: What Small Agencies Must Do Before January 1, 2026
Missouri's HB 974, signed July 2, 2025 and effective January 1, 2026, applies the NAIC Insurance Data Security Model Law to nearly every insurance licensee in the state — requiring a written security program, annual risk assessments, an incident response plan, vendor oversight, and breach notification to regulators within four business days.
NIST CSWP 50: The First Federal Cybersecurity Guide Written for Businesses of One
NIST's draft CSWP 50, released April 2026, is the first federal cybersecurity guidance written explicitly for non-employer firms — the 28+ million U.S. businesses with zero employees. Here's what changed from the 2009 guidance, how the CSF 2.0 six functions translate to a solo operation, and a 30-minute checklist to act on today.
IRS Contractor Data Security Failures: What the 2026 TIGTA Report Found — and How to Protect Your Tax Data
A 2026 TIGTA audit found 1,375 unauthorized entries into restricted taxpayer-document areas and critical vulnerabilities left unpatched an average of 223 days at IRS scanning contractors. Here is what the watchdog found, how the IRS responded, and the concrete steps — IP PIN enrollment, early filing, e-filing — that reduce your exposure.
North Korean 'Laptop Farm' Fraud: How Fake Remote Hires Infiltrated 100+ U.S. Companies — and the Red Flags to Check
Two U.S. nationals were sentenced to 108 and 92 months in federal prison for running a "laptop farm" that let North Korean IT workers pose as remote hires at more than 100 U.S. companies, funneling over $5 million to the regime. This guide explains how the scheme worked, why small businesses are prime targets, and the specific red flags — last-minute shipping-address changes, mismatched interview identities, unusual payment requests — to check before your next remote hire.
Why Every CPA Firm Needs a Written AI Policy Before the Next Staff Member Uses ChatGPT
73% of accounting firms now use AI tools but only 37% have any formal AI training, and staff pasting client data into consumer chatbots can trigger data breach notification duties under the AICPA's Confidential Client Information Rule — here is what a usable two-page AI policy for a small CPA firm actually covers.