Tag Archive for: cybersecurity

Avoiding a Cybersecurity Upset: How One Business Lost Big During Tax Season

March Madness isn’t just for basketball—it’s also the perfect metaphor for cybersecurity. In the world of college hoops, you can’t rely on last year’s strategies to win this year’s championship. Your competitors are constantly improving, analyzing past plays, and adjusting their tactics. The same applies to cybersecurity—especially for businesses handling sensitive financial data.

Unfortunately, one accounting firm learned this lesson the hard way last tax season. Before working with us, they believed their existing security measures were enough to protect them, but cybercriminals were playing a much more advanced game. Their lack of email security and data hygiene left them vulnerable, and when tax season rolled around, they suffered a devastating loss.

The Play-by-Play: A Costly Mistake

Everything seemed normal in early March. The firm’s accountants were busy filing returns and managing financial documents for their clients. Then, it happened—one of their employees received an urgent email that appeared to be from a longtime client requesting a tax return update. The email was well-crafted, used the client’s real name, and contained no obvious red flags. Without second-guessing, the employee responded, attaching sensitive financial documents.

A few days later, the real client called, confused. They hadn’t sent that email. It was a business email compromise (BEC) attack, and now, the cybercriminal had access to highly confidential tax documents, Social Security numbers, and financial records. By the time the firm realized what had happened, thousands of dollars were stolen in fraudulent tax refunds, and their reputation was on the line.

What Went Wrong?

Just like trying to rely on the same roster year after year in basketball, the firm was relying on outdated security strategies. Here’s where they fell short:

  • No DMARC Policy – Their email domain lacked proper authentication protections, allowing cybercriminals to spoof their email addresses and trick employees.
  • No Multi-Factor Authentication (MFA) – A hacker had previously compromised an employee’s email account, and without MFA, it was easy to use that access to gather more intelligence.
  • No Secure File Transfer Policy – Employees were sharing sensitive tax documents over email instead of using encrypted portals.
  • Lack of Employee Awareness – The firm had no regular cybersecurity training, so employees weren’t trained to spot sophisticated phishing scams.

Adjusting the Game Plan: How They Recovered

After the breach, they reached out to Go West IT for help, and we immediately stepped in to strengthen their cybersecurity, ensuring they never faced an upset like this again. We implemented:

DMARC, DKIM, and SPF Policies – To prevent email spoofing and ensure only legitimate emails were sent from their domain.

Multi-Factor Authentication (MFA) – Adding an extra layer of security for email logins and financial platforms.

Encrypted File Sharing – Transitioning the firm to a secure document-sharing platform rather than using email attachments.

Phishing Awareness Training – Conducting simulated phishing campaigns to test and train employees to recognize scams.

24/7 Email Monitoring – Installing advanced email security solutions to detect and block suspicious activity before it reaches employees.

Tax Season & Cybersecurity: Don’t Leave Your Business Vulnerable

Tax season is already stressful enough—don’t make it harder by leaving your business exposed to cyber threats. Cybercriminals are constantly evolving, just like the competition in March Madness. If your security strategy hasn’t been updated recently, you’re taking a gamble on your business.

Instead of guessing who might attack next, fortify your defenses. Let Go West IT help you develop a winning cybersecurity game plan that protects your business from tax fraud, email compromise, and financial theft.

Are your cybersecurity defenses ready for the next big game? Contact Go West IT today to ensure you’re prepared for whatever threats come your way.

Why Businesses Need to Act on DMARC Reject Policies Now

Email security is undergoing a major shift, and if your business relies on email communication (as most do), it’s time to pay attention. You may start hearing more about DMARC (Domain-based Message Authentication, Reporting, and Conformance) and its impact on email deliverability. Large email providers like Google and Yahoo are now enforcing stricter DMARC policies, requiring organizations to adopt better authentication measures—or risk having their emails rejected outright.

Ignoring these changes could mean disrupted communication with clients, vendors, and partners, increased susceptibility to email fraud, and damage to your business’s reputation. Here’s what you need to know and how to ensure your organization stays protected.

What is DMARC and Why Does It Matter?

DMARC is an email authentication protocol designed to prevent email spoofing and phishing attacks. It works in conjunction with SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to verify that the sender of an email is authorized to use a given domain.

With stricter DMARC enforcement policies now in place, emails that fail authentication may be rejected entirely or flagged as spam—significantly impacting your email communication and business operations.

How to Tell if an Email is DMARC Approved or Rejected

Understanding how DMARC policies impact email security is crucial. When an email is sent, email servers verify whether it passes authentication checks before allowing it into an inbox. If these checks fail, the email is either marked as spam or rejected altogether.

Here’s a quick comparison of what a DMARC-approved email looks like versus one that fails authentication:

DMARC Approved (Passes SPF, DKIM, and DMARC Checks)DMARC Failed (Rejected or Marked as Spam)
✅ From: support@yourcompany.com❌ From: support@yourc0mpany.com
✅ Sent via: yourcompany.com❌ Sent via: unknownserver.com
✅ SPF Alignment: Verified❌ SPF Alignment: Failed
✅ DKIM Signature: Valid❌ DKIM Signature: Missing or Mismatched
✅ DMARC Policy: Pass❌ DMARC Policy: None or Reject
✅ Lands in Inbox❌ Marked as Spam or Rejected

If your legitimate business emails are being marked as spam or failing to reach recipients, it may be time to review and implement a strong DMARC policy. Without it, your business could face email spoofing risks, phishing attacks impersonating your domain, and a loss of trust from customers.

The Business Risks of Ignoring DMARC Reject Policies

If your company’s domain lacks proper DMARC configurations, you could face:

  • Email Deliverability Issues: Emails sent from your domain may not reach clients, partners, or employees if they fail authentication checks.
  • Increased Cybersecurity Risks: Attackers frequently use domain spoofing to impersonate businesses in phishing scams. Without DMARC, your domain is vulnerable to misuse.
  • Regulatory and Compliance Challenges: Many industries, especially finance and legal sectors, are tightening email security requirements. Non-compliance could lead to fines or reputational damage.
  • Customer Trust Erosion: If fraudulent emails appear to come from your domain, your brand’s credibility takes a hit—leading to lost business and damaged relationships.

How Businesses Can Adapt and Secure Their Email Communication

The good news is that Go West IT has a solution. As a Managed IT and cybersecurity provider, we specialize in configuring and enforcing DMARC, SPF, and DKIM policies to secure business email communications. Here’s how we can help:

  • DMARC Policy Implementation: We assess your domain and establish an appropriate DMARC policy (Monitor, Quarantine, or Reject) to enhance security without disrupting legitimate emails.
  • Email Authentication Configuration: We properly configure SPF and DKIM records to align with your email-sending sources, ensuring all authorized emails pass authentication.
  • Ongoing Monitoring & Reporting: DMARC reports provide insights into who is sending emails on your behalf. We analyze these reports to detect unauthorized use and prevent future threats.
  • Strategic Rollout to Avoid Business Disruption: Enforcing DMARC too aggressively without monitoring can lead to unintended email rejections. We implement a phased approach, allowing you to monitor and adjust policies before moving to a full reject mode.

Stay Ahead of Email Security Threats

Email remains a primary attack vector for cybercriminals, and with the latest enforcement of DMARC policies by major providers, businesses must take action to protect their domains. Go West IT ensures your email security is up to modern standards—reducing your risk, maintaining email deliverability, and keeping your business communications secure.

Don’t wait until email failures or phishing attacks disrupt your business. Contact Go West IT today to ensure your email domain is secure and compliant with the latest DMARC policies.

Windows 10 Sunset: A Guide for Small Businesses

As of October 2025, Microsoft will officially end support for Windows 10, signaling the end of an era. For small businesses, this means the clock is ticking to secure your systems and prepare for the transition. Without updates, patches, or support, your systems could be left vulnerable to cyber threats and operational disruptions.

If your business runs on limited resources or lacks an in-house IT team, this can feel overwhelming—but it doesn’t have to be. With the right plan and support, you can transition smoothly and position your team for greater efficiency and security.

Why Small Businesses Need to Act Now

When an operating system reaches its end of life (EOL), it no longer receives critical updates, leaving your business exposed to serious risks:

  • Increased Cybersecurity Threats: Outdated systems are a prime target for hackers.
  • Compliance Risks: Unsupported software could lead to non-compliance with regulations, especially for businesses handling sensitive data.
  • Disruptive Compatibility Issues: Legacy systems might not work with modern software or devices, causing interruptions to your workflow.

The good news? By planning early, you can avoid costly disruptions and ensure your business stays secure and operational.

Option 1: Upgrade to Windows 11

If your current hardware is up to the task, upgrading to Windows 11 can be the simplest and most cost-effective solution. Windows 11 brings improved security features, better performance, and a modern interface designed to support today’s business needs.

Steps for Small Teams to Upgrade:

  1. Check Compatibility: Use Microsoft’s PC Health Check Tool to see if your hardware supports Windows 11.
  2. Back Up Critical Files: Ensure all important business files are securely backed up before starting the upgrade.
  3. Prepare for the Upgrade: Work with Go West IT or a trusted provider to handle the upgrade process. We’ll manage the technical details, so you can stay focused on your business. If you prefer to manage internally, ensure your current system is fully updated before initiating the upgrade. Then follow Microsoft’s upgrade instructions.

Option 2: Replace Outdated Hardware

If your systems don’t meet Windows 11 requirements, replacing them with new devices is the best path forward. While this may feel like a bigger investment, it’s an opportunity to modernize your business technology for faster, more efficient operations.

How to Transition Securely

  • Assess Your Needs: Determine the specifications and features you need for your business or personal use.
  • Migrate Data Safely: Use secure tools or IT professionals to transfer data to your new system. Avoid using unencrypted external drives or unsafe online transfer methods.
  • Decommission Old Devices: Properly wipe data from your old system before recycling or disposing of it. Use certified destruction services for sensitive data.

How Go West IT Makes Replacement Simple:

  • Needs Assessment: We’ll help you determine the best devices for your specific business requirements.
  • Secure Data Migration: Let our team handle moving your data safely from old devices to new ones—no technical know-how required on your end.
  • Proper Disposal of Old Devices: We’ll ensure your sensitive data is securely wiped and your old devices are responsibly recycled.

Staying Secure During the Transition

Data security is a top concern for small businesses, especially during upgrades or replacements. Go West IT ensures your transition is secure with managed services like:

  • Encryption: Protect your data during transfer and storage.
  • Endpoint Protection: Set up modern antivirus and security tools on your new system.
  • Multi-Factor Authentication (MFA): Secure your accounts and systems with added layers of protection.
  • Backup Management: Create reliable backups stored securely in the cloud or offsite.

Why Start Now?

Small teams often wear many hats, so last-minute tech changes can disrupt your operations. Starting early gives you time to prepare and avoids unnecessary downtime or stress. This type of technology transition may also require a great partner.

Partnering with Go West IT means you’ll get:

  • Tailored Planning: Solutions designed specifically for your small business.
  • Hands-Free Implementation: We handle the technical work, so your team can focus on their priorities.
  • Peace of Mind: Your systems will be secure and compliant, with minimal disruption.

Ready to Future-Proof Your Business?

Don’t let the Windows 10 sunset catch you off guard. Whether you’re upgrading to Windows 11 or replacing old systems, Go West IT specializes in helping small businesses make the transition seamlessly and securely.

Contact us today to plan your upgrade and keep your business running smoothly. Your future starts now.

Hidden Costs of Unused Cybersecurity Software

In the evolving landscape of cybersecurity, phishing remains one of the most persistent and damaging threats businesses face. To combat this, many organizations invest in software solutions to enhance their security posture. However, all too often, these tools are purchased as a “check-the-box” measure and left underutilized—or worse, completely unused. The result? Vulnerabilities persist, resources are wasted, and businesses remain exposed to the very risks they sought to mitigate.

The Problem with “Shelfware”

A common scenario: a company identifies phishing as a top concern and purchases an email filtering or endpoint detection and response (EDR) solution. Yet, the software is never fully set up, integrated into their systems, or managed effectively. It sits idle for years, offering no protection while silently draining budgets.

For example:

   • Phishing Prevention Tools: Businesses often invest in robust tools like email filtering solutions but fail to implement and monitor them correctly or run phishing campaigns to train employees.

   • Endpoint Detection and Response (EDR): Some companies run EDR software for years without proper configuration and more importantly monitoring, leaving systems vulnerable despite the illusion of security.

   • Incomplete IT Transitions: Organizations that start transitioning to new antivirus or other security platforms may abandon projects mid-way, leaving gaps in their defenses.

Why Managed Services Are the Solution

A managed service provider (MSP) like Go West IT solves this common issue by offering software, expertise, and execution in a single, comprehensive package. Here’s how partnering with an MSP delivers better outcomes:

  1. Cost Savings

MSPs often have access to enterprise-level pricing for software, meaning businesses can secure top-tier tools like Microsoft Defender, Azure Information Protection, CrowdStrike, Ironscales, and SaaSAlerts at lower costs. Consolidating software and services under one vendor eliminates the hidden costs of unused tools and duplicate solutions.

     2.    Full Integration

An MSP ensures that every tool—whether it’s an EDR platform or phishing prevention software—is fully set up, integrated with existing systems, and tailored to meet the organization’s unique security needs.  More importantly, it is aggressively monitored so important security events are dealt with in real time.

     3.    Ongoing Management

Cybersecurity is not a “set it and forget it” endeavor. MSPs provide continuous monitoring, updates, and management to ensure tools remain effective against evolving threats.

     4.    Improved Security Outcomes

With managed services, businesses benefit from expertly managed phishing campaigns, employee training, and proactive threat detection, ensuring comprehensive protection.

     5.    Streamlined Operations

Instead of juggling multiple vendors and tools, businesses work with one trusted partner who oversees every aspect of their security infrastructure.

Case Study: The Cost of Inaction

In one instance, a company purchased an EDR solution and ran it on their systems for five years without proper implementation. Not only were they paying for software that wasn’t protecting them, but their systems remained exposed to cyber threats during that entire period. A similar story is common with email filtering solutions like Mimecast—purchased but never leveraged to their full potential.

Had these businesses partnered with an MSP, they could have avoided wasted spend, mitigated risks, and achieved better results through a fully managed and optimized security solution.

Why Microsoft Solutions Matter

Microsoft offers a suite of security tools designed to address modern threats, particularly in email security. Solutions like Microsoft Defender for Office 365 provide advanced phishing protection, link detonation, and real-time monitoring, making them ideal for safeguarding against phishing attacks. When paired with MSP services, these tools can be fully leveraged to maximize both protection and value.

Make the Switch to Managed Services

Stop paying for unused or ineffective software. Partner with Go West IT to consolidate your cybersecurity tools, reduce costs, and ensure your defenses are always optimized. From phishing prevention to endpoint security, we bring the platform, expertise, and execution you need to stay ahead of threats.

Contact us today to learn more about managed services for your business!

Demystifying Cybersecurity Terms: Understanding What Really Keeps Your Business Safe

As cybersecurity threats continue to evolve, so do the terms and tactics associated with them. In reviewing industry guidelines on effective cybersecurity practices, we noticed a common challenge: many cybersecurity terms are frequently misunderstood. These misunderstandings can lead to confusion about what we actually do to protect our clients. One area that stood out was a glossary of commonly misused or misunderstood cybersecurity terms. Let’s dive into a few key terms to help clarify what they mean and why they’re essential for your business.

Common Cybersecurity Misunderstandings: What You Need to Know

1. Antivirus

Misunderstanding: Many people think antivirus software can protect against all types of cyber threats.

Clarification: While antivirus detects and removes malware, it doesn’t defend against threats like phishing or zero-day exploits. Comprehensive protection requires a layered approach, beyond just antivirus software.


2. Regulatory Compliance

Misunderstanding: Compliance with regulations automatically means a business is secure.

Clarification: Regulatory Compliance is about meeting baseline standards and guidance put forth by regulatory agencies.  Meeting regulatory compliance reduces regulatory risk and may reduce some real risk.  The cyber threat landscape evolves much more quickly than regulatory agency guidance and reducing real risk often requires going well beyond regulatory standards.


3. Firewall

Misunderstanding: Some believe a firewall blocks all threats and is the only layer of defense needed.

Clarification: A firewall monitors and controls traffic transversing your local network to the public Internet and sometimes between multiple company locations or cloud environments.  While necessary, a firewall only mitigates a portion of cyber risk and should be part of a multi-layered strategy to effectively protect your network, systems, data, and people.


4. Incident Response Plan

Misunderstanding: Some think an incident response plan only comes into play after a cyberattack.

Clarification: An effective incident response plan is proactive, established, and tested before an attack occurs. This ensures that everyone knows what to do when an incident happens, minimizing impact, accelerating recovery, and reducing risk.


5. Encryption

Misunderstanding: Encryption is often thought of as an unbreakable solution for data security.

Clarification: Encryption helps secure data by converting it to a coded form for data at rest and data in transit, but weak encryption methods, compromised keys, and human error can expose encrypted data to threat actors and thereby increase risk.   Regular review of cybersecurity controls, data storage and transit methods, and encryption key management and efficacy are critical to reduce risk on a constantly changing threat landscape. 

Why Understanding Cybersecurity Terminology Matters

At Go West IT, we often hear, “Aren’t you already doing that?” from clients who may not fully grasp the breadth of cybersecurity risk and mitigation tactics. The reality is, each term above represents a piece of a much larger puzzle. Without understanding the threat landscape and these terms, clients might assume they’re fully protected when, in fact, they’re only partially covered.

Going Beyond Basic Protection

Misunderstanding terms like “phishing,” “malware,” or “two-factor authentication” can lead to an underestimation of the risks and necessary protections. Cybersecurity isn’t just a checkbox; it’s an ongoing process that requires proactive measures and constant adaptation to new threats.

At Go West IT, we’re committed to comprehensive protection, addressing every layer of cybersecurity. From incident response planning to advanced threat intelligence, our goal is to keep you informed and secure, so you can focus on what you do best.If you’re unsure about your current cybersecurity posture, let’s talk about how we can protect you on your journey.


The Role of AI in Cybersecurity – The Double-Edged Sword of AI in Cyber Threats and Defense

Imagine you’re the head of a growing company. You’ve invested time and resources into securing your digital environment: firewalls are in place, staff have undergone cybersecurity training, and every software update has been meticulously applied. You feel prepared—until a new kind of threat emerges, one that operates faster, smarter, and more unpredictably. Attackers are now using artificial intelligence, leveraging the same technology you depend on for protection.

AI has revolutionized cybersecurity, enabling faster detection and response to threats. But it’s also giving cybercriminals powerful new tools to enhance their attacks, probe for vulnerabilities, and bypass traditional defenses. Understanding how AI can both empower and endanger your business is critical in today’s evolving threat landscape.

How Attackers Use AI

Cybercriminals are deploying AI in innovative ways, creating threats that are harder to detect and even harder to defend against. Here are some of the tactics they use:


Vishing and Deepfakes: AI can create convincing audio and video impersonations, making attacks like vishing (voice phishing) and identity impersonation more believable than ever.
Behavior Analysis: By analyzing user behavior, AI allows attackers to make social engineering attempts feel personal and authentic, increasing the likelihood that a targe will fall for the scam.
Automated Scanning and Targeting: Criminals use AI to automatically scan for vulnerabilities in systems and deploy attacks with unprecedented speed, targeting weaknesses as soon as they’re identified.

Defending Against AI-Enabled Threats with AI

To counter these AI-enhanced attacks, companies must leverage AI-powered defenses that adapt and respond in real time. This is where tools like Go West IT’s Go Secured | Advanced Endpoint (Endpoint Detection & Response, or EDR) come into play. By utilizing AI, these tools offer:


Real-Time Detection and Response: Go Secured | Advanced Endpoint monitors systems 24/7, using AI to detect unusual activity and respond immediately, minimizing the impact of potential breaches.
Enhanced Threat Analysis: With AI, EDR solutions can analyze patterns and learn from emerging threats, providing proactive protection against sophisticated cyber tactics.

Why AI-Enabled Security Matters for Businesses

The stakes are high. Traditional defenses alone can’t keep up with the pace and precision of today’s AI-driven attacks. Incorporating AI into cybersecurity strategy isn’t just a benefit; it’s a necessity. Here’s how AI-enabled security can strengthen your defenses:

Improved Accuracy: AI can process vast amounts of data, detecting threats that human analysts might miss and reducing false positives.
Speed and Efficiency: AI tools react instantly, analyzing and responding to threats in real time—essential in a world where every second counts.

Proactive Security for a Safer Future

Keeping up with attackers requires continuous adaptation. AI-powered solutions like those from Go West IT offer businesses a critical advantage, enabling them to anticipate and counter threats more effectively.

Are you ready to secure your systems with AI’s help? Contact Go West IT to learn more about how AI can serve as both your strongest defense and your competitive edge against AI-enhanced threats.

What Can You Learn From A Cyber Insurance Application?

Cybersecurity is one of the most critical concerns for small business owners today. A single cyber-attack can bring down a business, causing financial losses, reputational damage, and even legal liabilities. Business owners increasingly turn to cyber insurance policies to help mitigate cyber risk. These policies transfer some risk by providing resources, such as money and services, to deal with data breaches, network outages, and cyber extortion. However, cyber insurance is rarely sufficient to deal with the havoc that can ensue when a small business experiences an incident or breach.

Cyber insurance applications can teach small business owners a lot about effective cybersecurity risk management. Cyber insurance applications have grown from a few questions to many pages of questions as carriers seek to better assess risks based on the cybersecurity posture of their customers. This blog post will explore the key lessons that small business owners can learn from the questions asked on a cyber insurance application.

Current cyber insurance applications focus on the following topics:

  1. Endpoint Management
    Endpoint management refers to the management of laptops, desktops, servers, and mobile devices. Cyber insurance applications focus on endpoint management because endpoints are often the entry point for cyber attackers. Implementing endpoint management practices such as vulnerability scanning, patch management, and device encryption.
  2. Phishing Prevention
    Phishing is a type of cyber-attack where attackers use social engineering techniques to trick users into divulging sensitive information such as login credentials or credit card details. Phishing attacks are widespread and can be devastating for small businesses. Cyber insurance applications focus on phishing prevention because it is one of the most common types of cyber attacks. Small business owners can implement phishing prevention measures such as employee training, email filtering, and multi-factor authentication.
  3. Identity Management
    Identity management refers to managing user identities, access rights, and privileges. Identity management is critical for ensuring that only authorized users can access business data and networks. Cyber insurance applications focus on identity management because compromised user credentials are a common entry point for cyber attackers. Small business owners can learn from this and implement identity management practices such as password policies, enterprise password managers, user access control, and single sign-on (SSO).
  4. Data Backup Solutions
    Data backup solutions refer to the process of creating copies of business data and storing them in a secure location. Data backup solutions are critical for ensuring business continuity during a cyber-attack or other disaster. Cyber insurance applications focus on data backup solutions because they are critical for mitigating the impact of a cyber-attack. Application questions center around the segregation of backups because insurance companies know that cybercriminals will delete or encrypt backups if they can access systems. Small business owners can learn from this and implement data backup solutions such as cloud backup, offsite backup, and developing disaster recovery plans.
  5. Endpoint Detection & Response
    Endpoint detection & response refers to the process of detecting and responding to security incidents on endpoints through software and monitoring services. Endpoint detection & response is critical for detecting and responding to cyber-attacks before they cause significant damage. Cyber insurance applications focus on endpoint detection & response because it is a critical component of effective cybersecurity risk management. Small business owners can learn from this and implement endpoint detection & response measures such as threat hunting, incident response planning, and security monitoring.

The good news is that most IT-managed service providers and managed security service providers offer services to cover 100% of the risks cyber insurance companies focus on. If you cannot mitigate your cyber on your own, fast-track your risk mitigation and insurance readiness by contacting a managed security service provider like Go West IT.

Empower Solve Protect – Tracie Wilcox

Tracie Wilcox, President of On Tap Credit Union talks about how On Tap came to be, staying connected in a digital world, and the importance of work place culture. Watch the full video podcast here.

Empower Solve Protect – Jamie Yancy

Jamie Yancy. EVP, COO, and CTO of Native American Bank joins David to talk about the role technology plays in helping under served communities, trust, and his views on digital transformation. Watch the full video podcast here.

Empower Solve Protect – Amanda Moriuchi

Amanda Moriuchi, the CEO of Appit Ventures, joins David Lewien, the CEO of Go West IT to talk about why she does not use the term digital transformation, why the entrepreneurial experience is so sacred, and why not knowing might be the best advantage you have as a young entrepreneur. Watch the full video here.