MFA is a strong front-door lock. However, it is not the only thing that decides whether someone can get in.
After you sign in, your browser keeps you logged in using a session token (often stored as a session cookie). It is the digital version of a wristband at an event. Once you have been checked, the wristband proves you belong there. If an attacker steals that wristband, they may not need to beat your MFA prompt at all.
That is the core of session cookie hijacking. The attacker isn’t “cracking” MFA. They are skipping it by replaying your already authenticated session.
This is not a reason to stop using MFA. It is a reason to stop treating MFA as the finish line.
When sessions can be stolen, the practical defense shifts to layered controls: phishing-resistant sign-ins, device hygiene, tighter session policies and detection that catches suspicious access early.
Why MFA Isn’t a “Game Over” Control
MFA is still one of the best upgrades most businesses can make but it doesn’t end an attack on its own. The reason is that attackers don’t always try to beat the login step. They try to go around it.
Cloudflare notes that “attackers are finding new ways to circumvent MFA” and that modern incidents are rarely one isolated technique. They are part of a chain of attacks.
In other words, MFA can block a lot of credential theft but it doesn’t automatically protect what happens after a user successfully signs in.
That is where session cookie hijacking comes in.
Microsoft has described adversary-in-the-middle phishing campaigns where attackers use a reverse-proxy site to “steal and intercept” a user’s password and the session cookie that proves they have an authenticated session.
This is “not a vulnerability in MFA.” The attacker isn’t breaking the MFA. They are reusing the session.
What a Session Cookie Is and Why Attackers Want It
When you sign into a web app, the site needs a way to remember that you have already proved who you are. That is what a session is. It is a temporary “logged-in” state that saves you from entering your password and MFA code on every click.
Kaspersky explains that session hijacking is “sometimes called cookie hijacking” because cookies are commonly used to store the session identifier that keeps you authenticated.
Attackers want that session identifier because it is the shortcut.
Proofpoint describes session tokens as digital “keys” that let a user stay authenticated. It warns that stealing valid tokens lets attackers impersonate legitimate users and potentially bypass authentication measures “like MFA.”
That is why session cookie hijacking is so highly leveraged.
If an attacker can steal the cookie or token that represents your active session, they are not trying to defeat the login process. They are attempting to reuse what you already completed and access the same apps and data as if they were sitting at your keyboard.
How Session Cookie Hijacking Actually Happens
A lot of teams picture “account takeover” as someone guessing a password or tricking a user into approving an MFA prompt.
Session cookie hijacking is different. The attacker’s goal is to steal the proof that you are already logged in and then reuse it without triggering another sign-in challenge.
1.) AiTM Phishing
Adversary-in-the-middle (AiTM) phishing is the “proxy login” trap.
You think you are signing into a normal service but you are actually signing into a lookalike page that sits between you and the real site. The attacker relays the login in real time so everything appears to work (including MFA).
Attackers use AiTM phishing sites to “steal and intercept” a user’s password and the session cookie that proves the authenticated session. This is “not a vulnerability in MFA”. The attacker isn’t breaking the MFA. They are capturing the session after MFA is completed and reusing it.
One such campaign “attempted to target more than 10,000 organizations” since September 2021 which shows how scalable this approach has become.
2.) Browser-in-the-Middle Session Stealing
Browser-in-the-middle (BitM) is similar in spirit but it is even more “hands-on” from the attacker’s side.
Instead of stealing a password and running away, the attacker effectively places themselves in control of the browsing session.
Google’s threat intelligence says, “Stealing this session token is the equivalent of stealing the authenticated session.” Once the token is stolen, “an adversary would no longer need to perform the MFA challenge”.
In other words, the attacker isn’t trying to authenticate instead of you. They are trying to ride along after you have authenticated.
3.) Cookie Theft from the Endpoint
Not every session hijack starts with a fancy proxy. Sometimes the attacker simply steals session data from the device itself.
Stealing valid session tokens allows attackers to impersonate legitimate users. Tokens act like digital “keys.” If an endpoint is compromised, those “keys” can be extracted and reused.
Invicti explains that an attacker steals HTTP cookies and can gain access. The goal is often to obtain sensitive information stored in cookies.
MFA Is a Baseline Rather Than a Finish Line
MFA is still essential. It blocks a huge amount of credential theft and makes basic account takeover harder. However, session cookie hijacking is a reminder that attackers don’t always try to defeat the login step. Sometimes they reuse what happens after it.
The practical response is layered and realistic. Make phishing harder to pull off and treat device health as part of identity. Tighten session behavior for high-risk apps. Watch for suspicious access patterns that suggest a session is being replayed.
When those controls work together, MFA stops being a comforting checkbox and becomes what it should be: a strong baseline that is backed by protections around the session itself.
Contact us today for help protecting your login sessions from hijacking.
The most dangerous thing in a server room is often the phrase, “Don’t touch that.”
It is usually said with a half-joke and a grimace. It refers to the old box that “still works”, runs something important and has survived so many fixes and workarounds that nobody feels confident changing it anymore.
That is legacy debt.
Not just “old tech”. Old tech that has become a dependency. It is the kind that quietly accumulates risk until it turns into downtime, security exposure or an emergency upgrade at the worst possible time.
A legacy debt audit is the fast way to bring that risk back into the light.
What Legacy Debt Really Looks Like
Legacy debt isn’t “old gear”. It is old gear that has become normal.
It is the server that runs a critical app, the edge device nobody remembers buying or the workaround that turned into a dependency. Over time, that debt stacks up quietly.
Infinite Lambda describes legacy debt as something that “happens even to the best systems,” “silently accruing costs and constraints,” and it can “accumulate basically unnoticed until it is too costly to ignore.”
That is why a legacy debt audit isn’t a theoretical exercise. It is a visibility exercise to bring the oldest and highest-leverage risks back onto the list of things you actively manage.
The security problem shows up when “old” becomes “unpatchable”.
The UK’s NCSC guidance on obsolete products says, “Ideally, once out of date, technology should not be used,” and “the only fully effective way to mitigate this risk is to stop using the obsolete product.”
If something can’t be updated, weaknesses don’t age out. They sit there waiting for the wrong day.
Legacy debt also looks like basic server hygiene slipping.
NIST SP 800-123 frames secure server operations as an ongoing process: “Maintaining the secure configuration through application of appropriate patches and upgrades, security testing, monitoring of logs and backups…”
It also calls out foundational hardening steps like “Patch and upgrade the operating system” and “Remove or disable unnecessary services, applications and network protocols.”
When those basics become inconsistent, legacy debt turns into a reliability and incident-response problem instead of just a security one.
Legacy debt often hides at the edge. If you have end-of-support internet-facing devices, you have high-leverage risk in the most exposed place.
The 3 Oldest Risks to Find First
These three categories are where “old” most often turns into outsized risk because they combine age with leverage. They either sit at the front door, can’t be fixed anymore or have quietly drifted out of a safe baseline.
Risk #1: End-of-support edge devices
If you are looking for high-leverage legacy debt, start at the edge. Firewalls, VPN gateways, routers and other internet-facing devices are the front door to your environment.
When they reach end-of-support (EOS), they don’t just become outdated. They become harder to defend because security fixes stop arriving.
What to check in your audit
- List every edge device (firewall, VPN, router) and the support status for each one.
- Confirm which ones are internet-facing and which services are exposed.
- Identify devices that can’t run the current firmware or no longer receive updates.
Risk #2: Obsolete products that can’t be fixed anymore
Obsolete products are the purest form of legacy debt. They include things that are still operating but no longer receive security updates. That means every new vulnerability becomes permanent.
In other words, there is no clever workaround that makes an unsupported system “safe”. There are only risk reductions until you can replace it.
What to check in your audit:
- Identify anything past support: server OS versions, appliances, old hypervisors and line-of-business apps.
- Flag systems that require exceptions like the ones with old protocols, weak auth and special firewall rules.
- Find the “business-critical but unsupported” systems.
Risk #3: “It still works” servers with neglected basics
This is the sneakiest risk because it looks normal.
The server is supported. The hardware runs. Nobody is complaining. However, the basics have drifted. Patching is inconsistent, unnecessary services are still running and backups have not been proven under pressure.
SP 800-123 Guide to General Server Security frames secure server operations as an ongoing discipline including “patches and upgrades”, “monitoring of logs” and “backups.”
It also calls out core hardening steps like “Patch and upgrade the operating system” and “Remove or disable unnecessary services, applications and network protocols.”
Those are the unglamorous fundamentals that stop small problems from turning into long outages.
What to check in your audit:
- Patch reality: What is the current patch level and how often do updates slip?
- Service sprawl: What is running that doesn’t need to be running?
- Admin and service accounts: Where are the broad permissions and shared credentials?
- Backup confidence: When was the last restore test and did it succeed?
- Change control: Who can make changes and how are they tracked?
Stop Carrying Silent Risk
Legacy debt doesn’t announce itself. It sits quietly in the background until the day it becomes downtime, exposure or an emergency upgrade you didn’t plan for.
A legacy debt audit gives you control back by turning “we should deal with that someday” into a shortlist you can act on. Start with the highest-leverage risks like end-of-support edge devices, obsolete products that can’t be patched and servers where the basics have drifted. Then assign owners, set dates and move one item at a time from “too scary to touch” to “handled”.
Contact us for help running your next legacy debt audit.
Article summary: The software your business already uses has quietly gained AI capabilities. An AI software security audit helps you identify which AI features are active across your tools, what data they can access and whether vendor terms have changed in ways that affect your privacy or compliance obligations. Read more
Article summary: Browser extensions feel small but they operate inside your browser with access to passwords, session tokens, browsing activity and the content of every page your team visits. A quarterly audit process, a clear approval path and permission-based review close most of these gaps without disrupting how your team works.Read more
Article summary: Local admin rights are one of the most overlooked drivers of the repeat support tickets you submit to your IT provider. Most admin access was granted years ago for a one-time need and never removed, leaving your provider's team managing dozens of individually customized machines. By revoking local admin rights and replacing them with a controlled elevation process, you stabilize your endpoints, shrink your attack surface, and cut your support queue at the same time.Read more
When you first sign up for a software-as-a-service (SaaS) platform, everything is designed to feel effortless.
The problem is that the first real test of a SaaS relationship isn’t the onboarding. It is the exit.
For many small businesses, the front door is wide open but the emergency exit is bolted shut. Exports are incomplete, key data sits in proprietary formats and leaving requires expensive vendor help.
That is more than inconvenient. It is a business risk.
As teams move toward a workforce blended with humans and Agentic AI in 2026, your advantage will come from data you can move, reuse and trust. If your data can’t leave a vendor cleanly, you don’t fully control your processes. Then your options, timelines and costs are controlled for you.
Why This Gets Worse in 2026
The “backup exit strategy” question is getting sharper in 2026 because SaaS sprawl and third-party dependence are now normal.
Your business data isn’t sitting in one system. It is spread across platforms, integrations, plug-ins and automation. When one vendor changes pricing, terms, features or risk profile, you don’t just “switch tools.” You either move your data cleanly or you stay stuck.
The breach environment also raises the stakes. Verizon’s 2025 DBIR Executive Summary says it analyzed 22,052 security incidents and 12,195 confirmed breaches and called it “the highest number of breaches ever analyzed in a single report” across 139 countries.
That volume matters because exits and migrations often happen under pressure. A backup exit strategy is what prevents “we need to move” from becoming “we can’t move.”
Attackers are also increasingly focused on credentials and data pathways. These are the same pathways you rely on during exports and migrations.
Microsoft’s Digital Defense Report 2025 notes that credential and access key theft attempts are up 23% and attempts to extract sensitive data from storage accounts and databases increased 58%.
Microsoft also reports that data collection showed up in 80% of reactive engagements which is a reminder that “getting the data” is now a common objective.
If you can’t export your data safely and predictably, you end up trapped. You can’t rotate away from a risky platform quickly and you can’t migrate without creating new exposure.
Being stuck is expensive even before you factor in vendor fees. IBM’s Cost of a Data Breach Report 2025 puts the global average cost of a breach at USD 4.4M.
That is not a “lock-in” statistic but it is a useful reality check. Data incidents cost real money. A clean exit strategy reduces the chance that a vendor becomes an added cost multiplier during an already expensive situation.
In 2026, the question isn’t whether you will ever need to move data. It is whether you will be able to do it without vendor hand-holding, surprise costs or emergency timelines.
The Financial Cost of the "Proprietary Trap"
A weak exit plan doesn’t just slow innovation. It quietly increases operating costs because you end up paying for a setup you can’t easily change.
When you are locked into a vendor, spending becomes sticky. You can’t right-size quickly, consolidate tools or move workloads to a better-fit platform without turning it into a major project.
That is how waste hangs around.
The real cost isn’t the monthly invoice. It is the lack of options. When your data can’t move easily, every renewal, pricing change or product shift becomes a forced decision instead of a strategic one.
A true backup exit strategy flips that dynamic. It gives you the ability to migrate on your timeline, reduce duplicate tooling and make cost decisions based on value rather than inertia. In practical terms, it turns “we can’t leave” into “we can compare, choose and move when it makes sense”.
Securing the Move
Once you decide to move your data, the migration itself becomes a high-risk moment. This is not because migrations are inherently unsafe but because they concentrate exactly what attackers want:
- High-privilege access
- Lots of open sessions
- A lot of data moving at once
During a data move, your team is often signed into multiple admin-level tools at the same time. That is where session cookie hijacking becomes relevant. An attacker doesn’t need to “crack” your password if they can steal the session token that proves you are already authenticated.
Microsoft has described adversary-in-the-middle phishing campaigns that intercept session cookies so attackers can reuse an authenticated session and bypass the MFA prompt.
Cloudflare also notes that attackers are finding ways to circumvent MFA as part of broader attack chains which is why the safest approach is layered rather than relying on one control.
To protect your backup exit migration:
- Use phishing-resistant sign-ins where possible for migration and admin accounts.
- Tighten session controls so privileged sessions expire sooner and re-authentication is required for risky actions.
- Treat device health as part of access. Run the migration from a managed, patched and protected device.
- Monitor for suspicious access during the move.
Ownership is a Discipline
The businesses that thrive over the next few years won’t just adopt new tools. They will stay flexible as tools change.
In a world of SaaS sprawl and AI-driven workflows, that flexibility comes from clean data, clear processes and the ability to move when you need to.
If you would like help building an exit-ready baseline across your vendor stack, contact us for a technology consultation.
A fake recruiter message is one of the cleanest social engineering tricks around because it doesn’t look like a trick.
That is why LinkedIn recruitment scams work so well inside real businesses.
They don’t arrive as malware. They arrive as a normal conversation that nudges someone toward one small action. Click this link, open this file, “verify” this detail and move the chat to a different app.
A few simple checks, a couple of hard-stop rules and an easy way to report suspicious outreach can shut these scams down without slowing anyone down.
LinkedIn Recruitment Scams
LinkedIn recruitment scams artfully blend into normal professional behavior.
The message doesn’t look like a “cyber attack.” It looks like networking and it borrows credibility from recognizable brands, polished profiles and familiar hiring language.
At platform scale, the volume is also hard to wrap your head around.
Rest of World reports that LinkedIn said it “identified and removed 80.6 million fake accounts” at registration from July to December 2024. A LinkedIn spokesperson claimed “over 99%” of the fake accounts they remove are detected proactively before anyone reports them.
Even with that level of detection, enough scam activity still leaks through to reach real employees. That is especially true when scammers tailor their approach to what looks credible in a specific industry and location.
The other reason these scams succeed is that they follow a predictable persuasion pattern: urgency, authority and a quick push to “do the next step.”
The FTC describes scammers impersonating well-known companies and then steering targets toward actions that create leverage. These actions include handing over sensitive personal information or sending money for “equipment” or other upfront costs.
Once someone is rushed into treating the process as real, the scam doesn’t need to be technically sophisticated. It just needs the victim to keep moving.
The Scam Pattern Most Teams Miss
1. A polished approach on LinkedIn
The profile looks credible enough, the role sounds plausible and the message is written in a professional tone. The job post itself may still be oddly generic though.
Amoria Bond notes that fake job postings often “lack details” and lean on broad language to catch as many people as possible.
2. A quick push off-platform
The conversation shifts to email, WhatsApp/Telegram or a “recruitment portal” link. That shift is important because it removes the built-in friction of LinkedIn’s environment and makes it easier to send links, files and instructions.
3. A credibility wrapper: “assessment”, “interview pack” or “onboarding”
Airswift flags link/attachment requests and urgency tactics as common red flags. The story is usually something like: “Download this assessment”, “Review these onboarding steps” or “Log in here to schedule.”
Tag Apps
Make decisions visible and repeatable by tagging apps.
Microsoft explicitly calls tagging apps as sanctioned or unsanctioned an important step because it lets you filter, track progress and drive consistent action over time.
4. The pivot: money, sensitive info or account takeover
Scammers impersonate well-known companies and then ask for things legitimate employers typically don’t: payment for “equipment” or early requests for personal information.
Another variation is more subtle: “verification” steps that are really designed to steal identity details or compromise accounts.
5. Pressure to keep moving
If someone hesitates, the scam leans on urgency: “limited slots”, “fast-track hiring” or “complete this today”. That is why Forbes frames the key skill as slowing down and checking details because the scam depends on momentum.
Red Flags Checklist for Staff
Here are the red flags to look out for.
Red flags in the job posting
- The role is oddly vague or overly broad. Generic responsibilities, unclear reporting lines and “we will share details later” language are common in fake listings.
- The company's presence doesn’t match the brand name. Thin company pages, inconsistent logos/branding or a web presence that feels incomplete are worth pausing on.
- The process is “too easy and too fast.” If the listing implies immediate hiring with minimal steps, treat it as suspicious.
Red flags in recruiter behavior
- They push you off LinkedIn quickly. Moving to WhatsApp/Telegram or personal email early is a common tactic.
- They use a personal email address or unusual contact details. Be specifically cautious of recruiters using free webmail accounts instead of a company domain.
- They avoid verification. If they dodge basic questions, treat that as a signal rather than a scheduling issue.
Hard-stop requests
- Any request for money or fees. Application fees, equipment purchases, “training costs”, gift cards or crypto is a hard stop.
- Requests for sensitive personal info early. Bank details, identity documents, tax forms or “background checks” before a real interview process is established.
- Requests for verification codes. If anyone asks you to read back a one-time code sent to your phone/email, assume they are trying to take over an account.
- Requests for non-public company information like org charts, internal system details, client lists, invoice processes and security tools. Look out for requisitions for anything beyond what a recruiter would reasonably need.
Stop Scams With Simple Defaults
LinkedIn recruitment scams don’t succeed because staff are careless. They succeed because the outreach looks normal, the process feels familiar and the next step is always framed as urgent.
The fix isn’t turning everyone into an investigator. It is setting simple defaults that make scams harder to complete. Slow down before clicking, verify the recruiter and role through official channels, keep conversations on-platform until identity checks out and treat money requests, code requests and early personal data demands as hard stops.
When those habits are standardized, the scam loses its leverage.
Reach out to us today to make sure you have the latest tools to fight this and other types of scams.
At home, security incidents don’t look like dramatic movie hacks. They look like stepping away from your laptop during a delivery or leaving it unlocked while you grab something from another room.
Those ordinary moments repeated over time are how work devices end up exposed.
A remote work security checklist focuses on simple and practical controls that hold up in real life. Put it in place once, make it routine and you will prevent the kinds of issues that hurt most because they were entirely avoidable.
Why Home Is a Different Security Environment
A work laptop doesn’t magically become “less secure” at home. However, the environment around it does.
In the office, there are built-in boundaries: fewer shared users, fewer casual touchpoints and more predictable networks. At home, that same laptop is suddenly operating in a space designed for convenience rather than control.
For starters, physical exposure goes up.
At home, devices move from room to room, sit on tables and countertops and are left unattended for short stretches throughout the day.
That is why a remote work security checklist must treat physical security as part of cyber security.
In its training on device safety, CISA stresses the basics: keep devices secured, limit access and lock them when you are not using them. Those simple habits matter more at home because there is no “office culture” quietly enforcing them for you.
Home is where work and personal life collide and that creates messy and very human risks.
The NI Cyber Security Centre is blunt about it. Don’t let other people use your work device and don’t treat it like the family laptop.
The network is different.
Home Wi-Fi often starts with default settings, old router firmware or passwords that have been shared with everyone who has ever visited.
CISA’s guidance on connecting a new computer to the internet offers the baseline steps many people skip at home. Secure your router, enable the firewall, use anti-virus and remove unnecessary software and default features.
Remote access raises the stakes for identity. In its remote workforce security guidance, Microsoft’s best practices frames remote security around a Zero Trust approach and emphasizes that access should be strongly authenticated and checked for anomalies before it is granted.
The Remote Work Security Checklist
Use this remote work security checklist as your “minimum standard” for company laptops at home. It is designed to be practical, repeatable and easy to enforce without turning everyone into part-time IT employees.
Lock the Screen Every Time You Step Away
Set a short auto-lock timer and get into the habit of locking manually even at home.
Store the Laptop Like It Is Valuable
Assume that “out of sight” is safer than “out of the way.” When you are finished, store your device somewhere protected rather than on the couch, the kitchen counter or in the car.
Don’t Share Work Laptops with Family
At home, good intentions can still lead to accidental clicks. Even a quick “just checking something” can result in risky downloads, unfamiliar logins or unwanted browser extensions.
Use a Strong Sign-In and MFA
Use a long passphrase instead of a clever but short password and never reuse it across accounts. Treat multifactor authentication (MFA) as a baseline requirement instead of a nice extra.
Stop Using Devices That Can’t Update
If a laptop can’t receive security updates, it is not a work device. It is a risk.
Patch Fast
Updates are where most known issues get fixed. The longer you wait means the bigger the risk. Enable automatic updates and restart when prompted.
Secure Home Wi-Fi Like It Is Part of the Office
Use a strong Wi-Fi password and enable modern encryption. If your router still has the default admin login or hasn’t been updated in a long time, consider that your cue to fix it.
Use the Firewall and Keep Security Tools Switched On
Turn on your firewall, keep antivirus software active and make sure both are properly configured. If security tools feel inconvenient, don’t switch them off. Address the friction instead.
Remove Unnecessary Software
The more apps you install means the more updates you need to manage and the more opportunities there are for something to go wrong. Remove software you don’t need, disable unnecessary default features and stick to approved applications from trusted sources.
Keep Work Data in Work Storage
Storing work data in approved systems keeps access controlled, audit-ready and much easier to recover if something goes wrong. Avoid saving work documents to personal cloud accounts or personal backup services.
Be Wary of Unexpected Links and Attachments
If a message pressures you to click, open, download or “confirm now” treat it as suspicious. When in doubt, verify the request through a separate trusted channel before taking any action.
Only Allow Access From “Healthy Devices”
The safest remote setups gate access based on device health. Microsoft warns that unmanaged devices can be a powerful entry point and stresses the importance of allowing access only from healthy devices.
Are Your Laptops “Home-Proof”?
If you want remote work to remain seamless, your devices need to be “home-proof” by default.
That means treating the fundamentals as non-negotiable: automatic screen locks, secure storage, protected sign-ins, timely updates, properly secured Wi-Fi and work data stored only in approved locations.
Nothing complicated. Just consistent execution.
Start by adopting this remote work security checklist as your baseline standard. When the defaults are strong, you reduce avoidable incidents without slowing anyone down.
If you would like help turning these basics into a practical and enforceable remote work policy, contact us today. We will help you standardize protections across your team so remote work stays productive and secure.
If you want to uncover unsanctioned cloud apps, don’t begin with a policy. Start with your browser history.
The cloud environment most businesses actually use rarely matches the one shown on the IT diagram. It is built through countless small shortcuts: a “just this once” file share, a free tool that solves one problem faster, a plug-in installed to meet a deadline or an AI feature quietly enabled inside an app you already pay for.
In the moment, none of it feels like a problem. It feels efficient. Helpful.
Until it isn’t. Then you realize business data is scattered across tools you didn’t formally approve, accounts you can’t easily offboard and sharing settings that don’t reflect the actual risk.
Why Unsanctioned Cloud Apps Are a 2026 Problem
Unsanctioned cloud apps have always existed. What has changed this year is the scale, the speed and the fact that “cloud apps” now include AI features hiding in plain sight.
Start with scale. Microsoft’s shadow IT guidance points out that most IT teams assume employees use “30 or 40” cloud apps but "in reality the average is over 1,000 separate apps.”
It also notes that “80% of employees use non-sanctioned apps” that haven’t been reviewed against company policy. That is the uncomfortable reality of unsanctioned cloud apps. The gap between what you believe is happening and what is actually happening is often far wider than expected.
Now add the 2026 twist. AI is not just a standalone tool employees consciously choose to use.
The Cloud Security Alliance notes that AI is increasingly embedded as a feature within everyday business applications rather than existing only as a standalone tool. In other words, you can have shadow AI risk without anyone signing up for a new AI product. It is just there.
That creates a different kind of exposure. The same Cloud Security Alliance article cites research showing “54% of employees” admit they would use AI tools even without company authorization.
It also references an IBM finding that “20% of organizations” experienced breaches linked to unauthorized AI use which added an average of “$670,000” to breach costs.
This isn’t just a governance problem. It is a measurable risk problem.
The final reason 2026 feels different is the old “block it and move on” strategy no longer works. The Cloud Security Alliance has pointed out that simply blocking cloud apps is not an option anymore because cloud services are woven into everyday work. If you don’t provide a secure alternative, employees will find another workaround.
Don’t Start with Blocking
The fastest way to drive cloud app usage further underground is to treat it as a discipline problem and respond with bans.
Some applications do need to be blocked. However, if blocking is your first move, it typically creates two unintended side effects:
- People get better at hiding what they are doing.
- They switch to a different tool that is just as risky or worse.
Either way, you haven’t reduced the problem. You have just made it harder to see.
A better starting point is to understand what is happening and why.
The recommendation is to evaluate cloud app risk against an “objective yardstick”. You should monitor what users are actually doing in those apps so you can focus on the behavior that creates exposure rather than just the name of the tool.
Once you have that visibility, you can respond in a way that actually lasts. Some apps will be approved. Others may be restricted. Some will need to be replaced.
And the truly high-risk ones? Those are the apps you block thoughtfully with a clear plan, a communication message and a secure alternative that allows people to keep doing their jobs.
The Practical Workflow to Uncover Unsanctioned Cloud Apps
This is not a one-time clean-up. It is a workflow you can run quarterly (or continuously) to stay ahead of new tools and new habits.
Discover What is Actually in Use
Start by generating a real inventory from the signals you already collect: endpoint telemetry, identity logs, network and DNS data and browser activity.
Microsoft’s shadow IT tutorial emphasizes a dedicated discovery phase because you can’t manage what you haven’t first identified.
Analyze Usage Patterns
Don’t stop at identifying which apps are in use.
Review things like:
- Who is accessing cloud apps
- What admin activity is happening
- Whether data is being shared publicly or with personal accounts
- Access that should no longer exist such as former employees who still have active connections
Score and Prioritize Risk
Not every unsanctioned app is equally dangerous.
Use a simple risk lens:
- The sensitivity of the data involved
- How information is being shared
- The strength of identity controls
- The level of administrative visibility
- Whether AI features could be ingesting or exposing data
Tag Apps
Make decisions visible and repeatable by tagging apps.
Microsoft explicitly calls tagging apps as sanctioned or unsanctioned an important step because it lets you filter, track progress and drive consistent action over time.
Take Action
Once an app is tagged, you can enforce the decision.
Microsoft’s governance guidance outlines two practical responses: issuing user warnings (a lighter control that encourages better behavior) or blocking access to applications that present unacceptable risk.
Just keep in mind that changes are not always immediate. Plan for communication and a smooth transition rather than triggering unexpected disruptions.
Your New Default: Discover, Decide, Enforce
Unsanctioned cloud apps aren’t disappearing in 2026. If anything, they will continue to multiply as new AI features appear inside the tools your team already relies on.
The goal isn’t to block everything. It is to create a repeatable operating model. Discover what is in use. Determine what is acceptable. Enforce those decisions with clear guidance and secure alternatives.
When you apply that consistently, cloud app sprawl stops being a surprise. It becomes another controlled and managed part of your environment.
If you would like help building a practical cloud app governance process that fits your organization, contact us today. We will help you gain visibility, reduce exposure and put guardrails in place without slowing productivity.
Article summary: AI voice cloning has made it possible for attackers to call your accounts payable team sounding exactly like your CEO and the requests they make follow a predictable formula. Deepfake voice scams are an evolution of business email compromise and AP teams are the primary target because they can move money. A simple voice check playbook is the most effective defense available.
The call sounds like your CFO. The cadence is right. The urgency is familiar.
A wire transfer needs to go out today. It is confidential. The normal approval process doesn't apply this time.
This is a deepfake voice scam and accounts payable teams are its most valuable target. Not because they are careless but because their job is to move money quickly when leadership asks.
Building strong controls around financial approvals is no longer just about locking down system access. It is also about what happens when the phone rings and the voice on the other end sounds exactly right.
Why Accounts Payable Teams Are the Primary Target
Accounts payable (AP) teams handle what attackers care about most which is payments. They process invoices, authorize wire transfers and manage vendor banking details. They are also trained to respond quickly to requests from leadership when a request comes marked urgent and confidential.
That combination of financial authority and habitual responsiveness makes AP teams the top target for impersonation-based fraud.
Business email compromise (BEC) has been among the most expensive fraud categories in the US for years. This is where attackers impersonate an executive or vendor over email to redirect payments. Now attackers are adding voice to the same playbook.
Business email compromise cost US businesses $2.77 billion in 2024 alone.
According to the FBI's 2024 Internet Crime Complaint Center report, BEC ranked as the second-highest source of financial losses across all cybercrime categories with over 21,000 complaints filed that year. Adding a cloned voice to the same attack makes the deception significantly harder to dismiss.
How a Deepfake Voice Scam Actually Works
A deepfake is AI-generated audio, video or both that realistically replicates a real person. In a voice scam, the attacker builds a voice clone from publicly available recordings.
Voice cloning tools require only a few seconds of sample audio to produce a convincing replica. The result matches the target's tone, cadence and accent closely enough to mislead people who speak with them regularly.
The FTC has flagged voice cloning as one of the most difficult scams to detect because it exploits a form of trust people aren't trained to question which is recognizing a familiar voice.
More than 1 in 4 executives say their organization has already faced a deepfake fraud attempt targeting financial or accounting data.
In a Deloitte poll, 25.9% of executives reported at least one deepfake incident in the past year and 51.6% expect attacks to increase.
The formula across every documented case is consistent: Authority (a trusted figure is calling), urgency (it needs to happen today) and secrecy (don't involve anyone else). These three levers are chosen specifically to suppress the verification habits that would otherwise stop the transfer.
It is the same impersonation logic behind reply-chain phishing attacks where attackers hijack trusted conversations to manufacture compliance. The difference is that voice is far harder to dismiss in the moment.
Three Scenarios Your AP Team Should Know
The details change. The structure doesn't.
The Urgent Wire Transfer
The "CFO" or "CEO" calls directly about a same-day transfer for a confidential deal. There is always a reason the normal approval chain shouldn't apply.
In early 2024, engineering firm Arup lost $25 million after a finance employee was convinced by a video call in which every participant (including the CFO) was AI-generated.
The Vendor Account Change
A familiar supplier calls to notify the AP team that their banking details have changed. The voice matches the contact on file. The request seems routine. This version is effective because it doesn't require an immediate transfer.
The Confidential Deal
An executive calls ahead of a public announcement and asks for a payment to move before news breaks. The secrecy framing is what makes this version effective. It gives the target a built-in reason not to verify with colleagues.
Your AP Team's Voice Check Playbook
The strongest defense against a deepfake voice scam isn't a detection tool. It is a consistent process your team follows every time regardless of how convincing a call sounds.
1. Never approve a payment based on a call alone.
A phone call is a heads-up rather than an authorization. Any payment request or account change should require confirmation through a second and pre-established channel before anything moves. Think of it as multi-factor verification for financial approvals. One input is never enough to confirm identity or intent.
2. Hang up and call back on a known number.
If a call creates urgency around a payment, hang up and call the person back on a number already verified in your systems. Not a number provided by the caller. Attackers can spoof caller ID and the number they give you may route directly back to them.
3. Set a team code word.
Pre-agreed verification phrases are a layer that voice technology cannot bypass. Ferrari executives foiled an executive impersonation attempt in 2024 simply by asking the caller a personal question the real CEO would have been able to answer.
4. Treat secrecy requests as a red flag.
Legitimate executives don't typically ask AP staff to bypass review processes or keep a payment confidential from colleagues. If a caller says "don't loop anyone else in" or "this needs to stay between us" treat that as a reason to escalate through official channels rather than a professional courtesy to honor.
5. Limit publicly available voice samples.
The FBI has warned that attackers harvest voice audio from public recordings including webinars, conference sessions, LinkedIn posts and social media. Encourage senior staff to think carefully about the volume of audio published under their name and particularly recordings where they speak at length.
Ready to Build Your Team's Defense?
Deepfake voice scams work because the voice sounds like someone your AP team already trusts. The protection isn't a technical product. It is a set of habits.
The businesses that stop these attacks aren't necessarily better equipped. They are just harder to rush.
Contact Sound Computers to schedule a consultation. We can help you put a practical AP security protocol in place and make sure your team knows what to listen for. Call us at (860) 577-8060, reach us online or email info@soundcomputers.net.
Article FAQs
What is a deepfake voice scam?
A deepfake voice scam uses AI-generated audio to impersonate someone you recognize and persuade you to take a financial action. The voice is cloned from publicly available recordings and the result can be convincing enough to fool people who interact with that person regularly.
Why are AP teams specifically targeted?
AP teams have direct authority over payments and are trained to respond quickly to instructions from leadership. That combination of financial control and responsiveness to urgency is exactly what attackers need.
How do attackers clone someone's voice?
Voice cloning software can produce a convincing replica from just seconds of audio sourced from webinars, recorded meetings, video posts or saved voicemails. The output closely matches the original speaker's tone, cadence and accent. Some tools are accessible to anyone with an internet connection and a free account.
What should my AP team do when they receive a suspicious call?
Hang up and call the person back using a number already verified in your systems rather than one provided by the caller. Require any payment or account change to be confirmed through a second channel before acting. If the caller emphasizes urgency or secrecy, treat that as a reason to pause and escalate rather than to proceed.