Do this: List the five logins that hold your money and your customer records, then check each one for a second factor a stolen password cannot beat. A six-digit code sent by text message no longer counts as one.
PASTE THIS
You are a security reviewer for a 20-person business. For each account listed below, answer in three lines: (1) is a passkey or a hardware key supported today? (2) what breaks in the business if this login is taken over by someone else? (3) the exact steps to add the strongest second factor this account supports, in order. Accounts: [list them here].
You'll get: A passkey-or-not verdict per login, the blast radius if one falls, and the exact steps that lock the money accounts today.
The note to send the team when fake AI login pages are circulating
Copy this into Slack or email and send it today. Heads up: fake ad-manager pages for ChatGPT, Gemini, Claude and Meta's Muse are harvesting real logins and one-time codes. The page draws a login box inside your browser, with an address bar that looks like the real one. It is not real. Three rules until further notice:
Reply read, so the desk knows it landed.
A code sent by text message is now a formality, not a defence. The fake page collects the password, relays it, then asks the victim for the code itself. Phishing-resistant means a passkey or a hardware key. Every account that can move money or export customers gets one this month, or the second factor is decoration.
Researchers have documented a phishing platform impersonating the ad products of ChatGPT, Gemini, Claude and Meta Muse, per The Hacker News. Clicking Connect opens a login window drawn inside the browser, with an address bar showing a real domain, and the operator then picks which one-time code the victim is asked for.
So what: before your next statement, have whoever holds the ad and cloud logins open each one from a bookmark rather than a link, and move every account that still takes a texted code to a passkey this week.
A free year of premium AI seats, if the firm is young enough
Anthropic expanded its Claude for Startups program: a free year of Claude Team with up to five premium seats and $1,000 in API credits, for companies founded in the last five years or funded in the last two, per CNBC and TechCrunch. So what: check the eligibility line this week, because a subsidised year is the cheapest way to stop paying list price on seats a small team already uses.
The FBI says the firewall problem is still open
The FBI and US Secret Service published a joint advisory confirming that attackers using credentials from the FortiBleed campaign are still locking organisations out of their own firewalls, with tens of thousands more victims, per The Register. So what: ask whoever manages your firewall this week, in writing, whether its management page is reachable from the internet and whether the admin passwords were rotated since the summer.
Finland halts two Google data centre builds
Finland's licensing and supervision agency ordered Google to suspend construction at two data centre sites until environmental impact assessments are finished, per BBC Technology, a month after the company announced a major investment there. So what: if a cloud or colocation contract is in front of you this quarter, get one line in writing before signing, naming who pays when the region's build slips.
This week's question: fake ad portals were harvesting logins for tools the team really uses. How does a small team check whether it has already happened? Start with the logins that can move money. List every account that can change bank details, approve payments or export customer records, then look for a sign-in nobody can explain: an unfamiliar device, a new country, a forwarding rule added quietly, a recovery address that changed. Then look for shared passwords, because a shared login cannot be traced or revoked cleanly. Two questions settle most of it: has this account got a passkey, and did anyone sign in somewhere unexpected last month? Fix the first this week.
Which login would hurt most if it fell today?
A. The one that can move money
B. The one holding customer records
C. The one the whole team shares
D. None, everything already uses a passkey
Reply with one letter — results next issue.
Which country's regulator told Google this week to suspend work on two data centres until environmental assessments are finished?
Answer tomorrow — and no, we are not printing it here.
YESTERDAY'S ANSWER
Which company authorised $150 billion of share buybacks this week, a record sum, as AI demand kept its order book full?
NVIDIA. Its board authorised the increase this week, the clearest sign yet that AI spending is still flowing to chips rather than to software seats.
About 5 minutes to read. One thing you can use today every issue.
Want a look at where AI could save your team 5+ hours a week? Reply AUDIT — the desk takes a handful of these a month.
Know an owner drowning in their inbox? Forward this — the 2-Minute Win is worth 2 minutes.
Forwarded this? Subscribe here
Sent by AI for Everyday Business.
8735 Dunwoody Place STE R, Atlanta, GA 30350