Patch Now, Prove It, and Lock Down Credentials
January's cybersecurity news is packed with action items for small and mid-sized businesses. From a massive Microsoft patch release to ransomware groups actively hunting for unpatched servers, there's plenty to keep your IT team busy.
The good news? Most of these threats are preventable with some straightforward steps. Let's break down what's happening and what you need to do about it.
Microsoft 365 & Google Workspace Security: 114 Reasons to Update Today
Microsoft's January 2026 Patch Tuesday was a big one. The update addresses 114 vulnerabilities, including three zero-day flaws. One of those zero-days, CVE-2026-20805, is already being actively exploited in the wild.
What does that mean for your business? Attackers are using this vulnerability right now to run malicious code on unpatched Windows systems. If your computers and Microsoft 365 apps aren't updated, you're leaving the door wide open.
This isn't just about Windows desktops either. The vulnerabilities affect multiple Microsoft products, so your servers, laptops, and cloud-connected apps all need attention.
What you should do:
- Update all Windows systems immediately. Don't wait for the weekend. This one is urgent.
- Check that automatic updates are actually working. Sometimes they get stuck or disabled without anyone noticing.
- Verify your Microsoft 365 apps are current. Open any Office app, go to File > Account > Update Options, and click "Update Now."
- Prioritize systems that handle sensitive data like customer information, financial records, or healthcare data.
If you haven't patched yet, consider this your friendly nudge. The longer you wait, the more time attackers have to find their way in.
Compliance & Cyber Insurance: Patching Is No Longer Optional
Here's something that might catch you off guard: your cyber insurance company is paying attention to your patching habits.
CISA (the Cybersecurity and Infrastructure Security Agency) and major insurers are now requiring businesses to patch specific known vulnerabilities. One example is CVE-2025-33073, an SMB protocol flaw that's been added to mandatory patch lists.
Why does this matter? If you get hit by ransomware and your insurer finds out you didn't patch a vulnerability they explicitly told you to fix, they can deny your claim. That's not a hypothetical. It's happening.
The insurance industry is also dealing with its own AI-related challenges. Contrary to what you might expect, AI isn't reducing costs for insurers. It's actually increasing the workload because every AI-generated risk assessment needs human review. Insurers are becoming more thorough, not less, and that means they're scrutinizing your security posture more closely than ever.
What you should do:
- Keep detailed patching logs. Document when patches were applied, which systems were updated, and who approved the changes.
- Track CISA's Known Exploited Vulnerabilities (KEV) catalog. If a vulnerability appears on this list, treat it as a priority.
- Review your cyber insurance policy. Understand what security requirements your insurer expects you to meet.
- Set up a monthly patching review process. Even if updates are automated, someone should verify they're actually completing.
Think of documentation as your receipt. If something goes wrong, you'll want proof that you did everything right.
Dark Web & Credential Defense: Stolen Passwords Are the #1 Entry Point
Here's a stat that should get your attention: 1 in 3 breaches start with stolen credentials. That's not phishing emails or fancy hacking techniques. It's simply logging in with a username and password that someone bought on the dark web.
Microsoft Entra ID (formerly Azure AD) accounts are especially popular targets. Once an attacker has valid credentials, they can access your email, files, and cloud apps without triggering traditional security alerts. To the system, it looks like a normal login.
Identity compromise is now the top ransomware vector. Attackers don't need to break in when they can just walk through the front door.
What you should do:
- Enable MFA on every account. No exceptions. If an app doesn't support MFA, consider whether you really need it.
- Use an authenticator app instead of SMS codes. Text-based MFA is better than nothing, but authenticator apps are more secure.
- Monitor the dark web for leaked credentials. Services exist that scan breach databases and alert you when your company's passwords appear.
- Train employees to use unique passwords. Password reuse is the silent killer of good security.
- Review sign-in logs regularly. Look for logins from unusual locations or at odd hours.
Your passwords are probably already floating around somewhere. MFA is the safety net that keeps stolen credentials from becoming a full-blown breach.
Cloud Cost & License Optimization: Stop Paying for What You Don't Use
This one isn't about hackers. It's about your budget. Studies consistently show that 20 to 30% of cloud spending goes to waste. That's money spent on unused licenses, forgotten Azure resources, and abandoned subscriptions.
Here's the security angle: those zombie licenses and orphaned accounts aren't just wasting money. They're also potential entry points. An unused account that still has access to your systems is an account an attacker could compromise without anyone noticing.
What you should do:
- Run a cloud audit. Identify all active licenses and Azure resources. Look for accounts that haven't been used in 90+ days.
- Disable or remove unused accounts. If someone left the company six months ago, their account shouldn't still be active.
- Review your license assignments. Are people paying for premium features they don't use?
- Redirect savings to security tools. The money you recover from trimming waste can fund better protection.
- Set up quarterly reviews. Cloud sprawl happens gradually. Regular check-ins keep it under control.
Cleaning up your cloud environment makes you more secure and saves money. That's a rare win-win in cybersecurity.
SMB Vendor, Supply Chain & Critical Vulnerabilities: Warlock Is Hunting
A ransomware group called "Warlock" is actively targeting businesses through SharePoint and SMB protocol vulnerabilities. They're specifically looking for unpatched file-sharing systems, exactly the kind of systems small businesses often forget about.
This isn't theoretical. Warlock is scanning networks right now, looking for easy targets. If your file servers or SharePoint instances haven't been updated recently, you might be on their list.
Supply chain attacks are also on the rise. That means even if your systems are secure, a vulnerable vendor or partner could become the entry point into your network.
What you should do:
- Prioritize patching for all file-sharing systems. SharePoint, Windows file servers, and NAS devices all need attention.
- Run network scans to find unpatched servers. You might have systems you forgot about.
- Review vendor security practices. Ask your key vendors about their patching and security policies.
- Segment your network. If a file server gets compromised, limit how far the attacker can move.
- Back up critical data offline. Ransomware can't encrypt backups it can't reach.
Your Quick Action Checklist
Feeling overwhelmed? Here's the short version:
- Update Windows and Microsoft 365 apps now, and confirm automatic updates are actually working.
- Keep patching logs and check what your cyber insurance policy requires.
- Turn on MFA everywhere and monitor for leaked credentials.
- Remove unused accounts and licenses, and review your cloud costs.
- Patch file-sharing systems (SharePoint, file servers, NAS) and keep offline backups.
None of these steps require expensive tools or specialized expertise. They just require attention and follow-through.
Wrapping Up
This roundup comes down to three themes: patch your systems, prove you did it, and protect your credentials. Attackers are getting more organized, insurers are getting pickier, and the basics still matter more than ever.
If you're not sure where your business stands on any of these items, a security risk audit can help you identify gaps before attackers do.
Stay safe out there.