Tag Archive for: cybersecurity

Microsoft 365 Compromise Detection and Response

Most people still picture a breach as someone breaking in — cracking a password, slipping past the firewall, tripping an alarm. That picture is out of date. Today, the most damaging Microsoft 365 compromises don’t look like a break-in at all. They look like a normal login.

We wrote recently about how attackers now walk around multi-factor authentication — stealing session tokens, relaying real Microsoft sign-in pages, and abusing legitimate features to get a valid session without ever needing your password again. Once they hold that session, they’re inside your environment as a trusted user. Nothing looks wrong. And that raises two questions most businesses can’t answer:

If someone were inside your Microsoft 365 right now, would you see it? And if they had been, could you prove exactly what they touched?

The Breach That Doesn’t Look Like a Breach

When an attacker logs in with a valid session, the front-door defenses have already done their job and moved on. MFA verified the user. Email security scanned the inbound messages. Both are essential — and both are looking at the entrance, not at what happens once someone is inside.

So the attacker settles in quietly. They read email to learn your billing cycles and who approves payments. They create a hidden inbox rule that auto-files their own messages so you never see the replies. They register an OAuth app to keep access even after a password reset. They browse SharePoint and OneDrive for the documents that matter. None of this trips a traditional alert, because none of it is technically an “attack” — it’s a logged-in user doing ordinary things, just not the real user.

This is the gap. Verifying who logged in is not the same as watching what they do next.

What Modern Microsoft 365 Detection and Response Actually Does

Closing that gap takes a different kind of monitoring — one built specifically for identity-based threats in Microsoft 365. Here’s what that looks like in practice:

  • Behavioral login analysis. Instead of asking only “is this login from an expected location?”, it studies the behavior of the session itself. That’s how it catches the attacks that pass location checks — logins routed through residential proxies, sessions riding on a stolen token, credentials that already cleared MFA.
  • Watching activity after the login. It monitors what actually happens inside the tenant — new inbox rules, app registrations, MFA method changes, mailbox and file access, unusual sends and deletions, permission changes. The tell-tale signs of a takeover live in these actions, not in the sign-in itself.
  • Fast, automated containment. When something is clearly malicious, waiting hours for a human to notice is waiting too long. The response can move immediately — ending the attacker’s sessions, removing the devices and MFA methods they registered, and deleting the malicious inbox rules they left behind — to shut the door before real damage is done.
  • Forensic reconstruction. After an incident, it rebuilds the full timeline: how they got in, what they accessed, what they changed, what left the building. Not guesswork — a documented account of exactly what happened.

Behind Go West’s service, this capability is powered by Petra Security, an identity threat detection and response platform purpose-built for Microsoft 365, backed by our 24/7 Security Operations Center. The technology sees the threat; our SOC investigates and responds — around the clock, including the nights and weekends when these attacks are timed to land.

Why the Forensic Record Matters as Much as the Alert

For a regulated business — an RIA, a law firm, a family office — detecting the compromise is only half of it. The other half is being able to answer, with confidence, what happened.

After a Microsoft 365 incident, you may need to tell a regulator, a cyber-insurance carrier, or an affected client precisely what was and wasn’t accessed. “We think we contained it” is not an answer that holds up. A clear forensic timeline — the attacker’s infrastructure, the mailboxes and files they touched, the data that did or didn’t leave — turns a frightening, open-ended event into a defined, defensible one. It shortens the incident, supports the insurance claim, and lets you make disclosure decisions based on fact rather than fear.

That’s the difference between an event that controls you and one you control.

The Part That Has to Happen First

Here’s what surprises most businesses: a forensic timeline is only as good as the data behind it — and Microsoft 365 does not capture all of that data by default. The detailed logging that reveals which mailboxes were opened, which files were accessed, and what left your tenant has to be deliberately turned on, configured correctly, and retained long enough to matter — before an incident, not after. Plug even the best detection tool into a tenant that was never logging the right activity, and it has very little to work with. The evidence you’ll want on your worst day is created by choices you make on an ordinary one.

This is exactly why the smart move is to be proactive. Preventing, detecting, containing, and remediating a compromise aren’t four products you scramble to buy in a crisis — they’re one posture you put in place ahead of time. That means getting the foundation right first: logging and retention configured properly, detection tuned to the right activity, containment ready to act, and a response team already on call. It’s the work worth doing with a partner like Go West IT while everything is quiet — so that if the day ever comes, it’s all already in place.

Both Sides of the Coin

Here’s the confident version of all this: identity-based compromise is real and it’s rising — and it is now something you can genuinely see, stop, and account for. The businesses that come through these events well aren’t the ones that never get targeted. They’re the ones who detect fast, contain automatically, and can prove exactly what happened.

This protection is now included in our Go Secured | Advanced Cloud service and in Go Managed | Comprehensive — no separate purchase, no bolt-on. If Microsoft 365 is where your business runs, this is the layer that watches what happens after the login.

Where to Start

  • Worried something may already be going on — an odd login alert, an email that didn’t sit right, a payment that went to the wrong place? Our free, no-obligation Microsoft 365 Compromise Assessment looks for the specific signs of a takeover and tells you plainly what we find.
  • Just want to know where you stand? Our free Microsoft 365 Security Assessment gives you a clear, prioritized picture of your environment, in plain language.
  • Ready to have this running quietly in the background? Let’s talk about Go Secured Advanced Cloud.

You can’t stop every attacker from trying. You can decide whether they get to operate in the dark. Go Boldly — we’ll guide the way.

Vendor Email Compromise and Invoice Fraud

Multi-factor authentication was supposed to end account takeover. For years, the advice was simple: turn on MFA and attackers move on to easier targets. That advice is now out of date.

Over the past year, attackers have shifted to techniques that don’t break MFA — they walk right around it. And the uncomfortable truth is that even a business with excellent security can still lose money to these attacks, because the weak link may not be your network at all. It may be a supplier’s.

Here’s what’s actually happening, and what to do about it.

How Attackers Get Past MFA Today

Modern account compromise rarely involves guessing a password. Three tactics dominate right now:

Adversary-in-the-Middle (AiTM) phishing. The victim clicks a link and lands on what looks exactly like the Microsoft sign-in page. It is the real login — the attacker is simply relaying it through their own server in the middle. The user types their password, completes MFA on their real phone, and everything works. But in that moment, the attacker captures the session token Microsoft issues after login — the digital “pass” that proves you’re already authenticated. With that token, they don’t need your password or your MFA again. Microsoft observed a single AiTM campaign hit 35,000 users in three days, and one incident-response firm found MFA failed to stop the attack in 84% of the cases it investigated.

Device-code phishing. This one abuses a legitimate Microsoft feature. The attacker sends what looks like a routine prompt (“enter this code to finish signing in”). The victim enters the code on the genuine Microsoft page and approves it with their own MFA. Because every step happens on Microsoft’s real infrastructure, nothing looks wrong — but the approval hands the attacker a valid access token. In May 2026 the FBI issued a public warning about Kali365, a subscription “phishing-as-a-service” kit built specifically to run this attack at scale using AI-generated lures.

Token theft and quiet persistence. Both methods produce the same result: the attacker gets access and refresh tokens rather than a password. That means they can stay in the mailbox for as long as the token is valid — often without tripping a single alert — reading email, learning your billing cycles, and studying who pays whom.

The common thread: MFA verifies you once, at the front door. Once an attacker holds a valid session, the door stays open behind them.

What We Can Do About It

The good news: this is defensible. Go West IT works with clients on projects to harden Microsoft 365 against exactly these techniques — phishing-resistant sign-in methods, Conditional Access policies that restrict risky flows like device-code authentication, and token protection and session controls that limit what a stolen session can do. And for clients on our Go Secured Advanced Cloud service, we provide proactive 24/7 monitoring that watches for the tell-tale sign of a stolen session: a familiar account suddenly signing in from an unfamiliar place or device. Together, these measures dramatically reduce the odds that your accounts become the entry point.

But here’s the part that matters most, and the reason we’re writing this.

The Gap You Can’t Close With Technology Alone

You can do everything right and still lose money — because the compromised mailbox doesn’t have to be yours.

Picture a supplier you pay every month. Their mailbox gets taken over using one of the tactics above. The attacker doesn’t send you a clumsy fake. They sit quietly inside the supplier’s real inbox, read the real invoice thread, and wait. When the genuine invoice goes out, they reply from the supplier’s actual address, inside the real conversation, with one change: new bank details, payment due Friday.

Every check your team knows to make passes. Right sender. Right thread. Right invoice number. Right amount. Nothing in your security stack fires, because nothing in your environment was breached. The money goes out — and weeks later the real supplier calls asking why they haven’t been paid.

No firewall, no MFA, and no monitoring on your side can catch this, because the fraud rides in on a legitimate relationship you’ve trusted for years. This isn’t an IT gap. It’s an operations gap — and the fix is operational.

  • Verify every change of bank or wire details by phone, using a number from your own records — never a number or link from the email itself.
  • Make that callback a written, mandatory step in your payment process, so skipping it is a policy breach, not a judgment call. Apply it to every vendor, including the ones you trust most.
  • Ask your suppliers to do the same in reverse. Your mailbox is somebody else’s supplier thread.

Strong technology and strong procedure aren’t alternatives — you need both. We’ll help you lock down the technology. But the callback is the control that protects you when the breach happens somewhere you can’t see.

That’s the confident way to operate on today’s digital frontier: verify the change, then pay without hesitation.

Want to know where your Microsoft 365 environment — and your payment procedures — stand today? Our free Microsoft 365 Security Assessment gives you a clear, prioritized picture in plain language. Or if something already doesn’t sit right, let’s talk.

AI Change Management

AI Adoption Is Change Management: Where Are We Going, and Why?

Most conversations about AI in business start with tools. Which model. Which license. Which app to try first. Those are fair questions, and they have real answers. But they are not the questions that determine whether AI actually takes hold in your organization — or quietly stalls after the initial excitement fades.

The harder, more important work is human. Adopting AI is one of the most significant change-management efforts a business will take on this decade. And change management, in the end, has never really been about technology. It has always been about people.

AI Changes the Work, Not Just the Toolset

When a new application shows up, people learn a few new buttons and move on. AI is different. It changes how work gets done — how a proposal gets drafted, how research happens, how a report comes together, how a decision gets informed. That kind of change reaches into how people see their own value and their own role.

Left unaddressed, that uncertainty shows up in predictable ways. Some people hesitate, waiting to be told it’s safe. Others quietly adopt tools on their own, outside any policy or oversight — the “shadow AI” problem that creates real exposure. Either way, the organization ends up with adoption that is uneven, unmanaged, and far below its potential.

None of that is a technology problem. It is a change-management problem. And it responds to the same things every successful change always has: intention, communication, and direction.

Lead With the Destination — and the Reason

The single most important thing a leader can do is tell people where the organization is going, and why.

The “where” gives people a destination to move toward instead of a tool to be handed. The “why” is what actually moves them. People adopt change when they understand the purpose behind it — when they can see how it serves clients better, removes friction from their day, or lets them spend their time on work that matters more. Without that reason, even the best tool becomes one more thing on the to-do list.

This is where a lot of AI rollouts go quiet. Leadership announces a license, sends a link, and expects momentum to follow. It rarely does. Direction and reason are what turn a tool into a shared goal.

What Intentional AI Adoption Looks Like

The businesses getting real value from AI tend to do a handful of things deliberately:

  • They set a clear direction. Not “everyone go experiment,” but a stated purpose: here is what we’re trying to improve, and here is why it matters to us and our clients.
  • They communicate early and often. People hear the reasoning directly from leadership, not through rumor. Questions and concerns are invited, not managed around.
  • They give people permission and a path. Clear guidance on what is encouraged, what is off-limits, and where to go for help removes the hesitation that stalls adoption.
  • They create champions. Early adopters who model good use and share what’s working carry the change further than any all-hands announcement.
  • They pair enablement with guardrails. A short, plain-language AI policy and basic training aren’t obstacles to adoption — they’re what let people move confidently, knowing the boundaries are clear.
  • They measure and celebrate progress. Naming real wins — hours saved, work improved — reinforces the direction and shows people the destination is worth moving toward.

Notice that most of this is communication, not configuration. The technology is the easy part. Bringing people along is the work.

The Guardrails Are Part of the Empowerment

It’s tempting to treat governance as the brakes on AI adoption — the thing that slows people down. In practice, it’s the opposite. When people know what data is safe to use, which tools are approved, and where the lines are, they stop hesitating and start using AI with confidence. Clear boundaries don’t restrict good work; they free people to do it.

This is why the people side and the security side of AI belong in the same conversation. Empowering your team and protecting your business aren’t competing priorities. Done well, they reinforce each other.

Moving Forward, Together

We’ve lived this ourselves. Go West IT builds its own tools, adopts AI across the firm, and has worked through the same questions we’re describing — how to point a team in a direction, how to explain the why, how to make adoption intentional rather than accidental. That experience is part of what we bring to the businesses we guide.

If your organization is standing at the edge of broader AI adoption, the most valuable thing you can do isn’t to pick the perfect tool. It’s to decide where you’re going, get clear on why, and bring your people with you.

That’s change management. It’s also leadership. And it’s the difference between AI that transforms how your business works and AI that never quite gets off the ground.

If you’d like a steady hand as you think through what intentional AI adoption looks like for your team, we’re here. Go Boldly — we’ll help guide the way.

Operational Security Constant

The One Thing You Can Control: Operational Security in an Age of AI Uncertainty

The AI era has introduced a lot of unknowns. Threats evolve faster than they used to. Attackers now use the same AI capabilities that businesses do — to find weaknesses, craft convincing lures, and move quickly once they’re in. The landscape shifts month to month, and the honest truth is that no one can predict exactly what the next threat will look like.

For business leaders, that creates a genuine dilemma. How do you manage a risk you can’t fully see? How do you invest confidently when the ground keeps moving?

Here is the reassuring part. Amid all that uncertainty, there is one constant — and it’s entirely within your control.

Fundamentals Don’t Depend on Predicting the Future

Operational security is the set of foundational practices that reduce your exposure regardless of what specific threat comes next. It isn’t glamorous, and it doesn’t make headlines. But it is the difference between an organization that is genuinely hard to compromise and one that simply hasn’t been targeted yet.

The reason operational security matters so much right now is precisely because the future is uncertain. You don’t have to know which vulnerability an attacker will use if the vulnerability was already patched. You don’t have to anticipate a stolen password if that account required multi-factor authentication and was being monitored for anomalies. Strong fundamentals protect you against threats you can name today and threats that don’t exist yet.

That is a rare thing in security: work you can do now that pays off against a future you can’t predict.

The Fundamentals Worth Acting On

Operational security isn’t a single product. It’s a handful of disciplines that work together. None of them require you to guess what’s coming.

  • Device management. You can’t protect what you can’t see. Knowing every device connected to your business — and being able to configure, patch, and control it — is the foundation everything else rests on.
  • Vulnerability management. New weaknesses surface constantly. Routine scanning finds what’s exposed in your environment so you can fix it before someone else finds it first.
  • Identity protection and monitoring. Identity is the modern perimeter. Multi-factor authentication, conditional access, and active monitoring for unusual sign-ins stop the majority of account-based attacks — the most common way businesses get breached.
  • Permission controls. People should have access to what they need and nothing more. Least-privilege access limits how far any single compromised account or mistake can reach.
  • Credential management. A business password manager, enforced MFA, and the elimination of shared or generic accounts close one of the most reliable doors attackers rely on.
  • Gateway and network-layer protections. A well-configured firewall, network segmentation, and modern secure-access controls keep threats out at the edge and contain them if they get in.

Individually, each of these is straightforward. Together, they form a security posture that holds up whether the threat is a decade-old technique or something AI surfaced last week.

Certainty You Can Buy in an Uncertain Time

There’s a natural temptation, in a fast-moving threat landscape, to wait for clarity — to hold off until the picture settles or the next tool arrives. But the picture isn’t going to settle, and no single tool is the answer. The organizations that stay ahead aren’t the ones with a crystal ball. They’re the ones that did the foundational work early and kept it current.

That’s the opportunity hiding inside all this uncertainty. While much of the AI-era threat landscape is genuinely unpredictable, your operational security is not. It’s assessable, achievable, and durable. It’s the part of your risk you can actually take off the table.

A Steady Partner for the Work

Operational security is ongoing, not a one-time project — devices change, people come and go, new vulnerabilities appear, and configurations drift. Keeping all of it current, all the time, is exactly the kind of disciplined, unglamorous work that’s easy to let slide when you’re focused on running your business.

That’s the work we do. Go West IT manages device fleets, vulnerability scanning, identity protection, access controls, credential management, and network defenses across hundreds of businesses — so the fundamentals stay strong without becoming a distraction from the work that moves your organization forward.

You can’t control what the AI-era threat landscape does next. You can control whether your operational security is ready for it. If you’d like to know where your organization stands — and where the meaningful gaps are — we’re here to help you see it clearly and move forward with confidence.

Go Boldly. We’ll guide the way.

Operational Security Best Practices: How to Stay Protected in the Age of AI Attacks

There’s an old saying that it’s better to be lucky than good. When it comes to protecting your business from cyber threats, that’s a gamble worth retiring.

We prefer a different version: the harder you work, the luckier you get. In cybersecurity, the organisations that look lucky when a major threat makes the news are almost always the ones that invested in operational security best practices long before the headline appeared; unglamorous, consistent work that quietly removes risk before any alert is published.

How AI Has Changed the Cybersecurity Threat Landscape

AI has fundamentally changed the economics of a cyberattack. For years, the raw materials for a breach – old leaked credentials, previously disclosed vulnerabilities, forgotten accounts, unpatched devices – have been sitting in the open. What’s changed is that attackers can now use AI to comb through years of those exposures and test them against live networks at a speed and scale that simply wasn’t practical before.

The FortiBleed activity is a recent example. It wasn’t a single, novel zero-day. It was a systematic recycling of vulnerabilities and credential leaks that were already known and already disclosed – assembled by AI into a working attack against internet-accessible firewalls and VPN gateways. The materials were old. The method was new.

That pattern isn’t unique to one vendor or one product. It’s the shape of the modern threat landscape: the cost of patience has dropped to near zero for attackers, which means the margin for “we’ll get to it eventually” has narrowed considerably for everyone else.

Lucky or Prepared? The Real Difference in Cybersecurity

Here’s the encouraging part. For organisations that had been practising sound operational security, an event like FortiBleed wasn’t an emergency; it was a normal course of business. Review the controls, confirm everything was in order, and move on.

That isn’t luck. It’s the compounding return on consistent work. The teams that hadn’t done the work spent that same week in a fire drill. Same threat, very different week.

The difference comes down to a handful of disciplines that, done routinely, quietly remove most of the risk before any alert is published.

Operational Security Best Practices: The Fundamentals That Work

Operational security isn’t a product you buy. It’s a set of habits you keep. The ones that matter most:

Routine firmware updates.

The devices that run your network – firewalls, switches, access points – need firmware maintained on a schedule, not whenever someone remembers. Outdated firmware is one of the most common ways old vulnerabilities stay exploitable long after a fix exists. If your team discovered FortiBleed through the news rather than through a patch notification, that’s a gap worth closing.

Managed software patching.

Patching should run on a defined cadence and be verified, not assumed. “The update was available” and “the update is installed and the system rebooted” are very different things, and only one of them protects you.

Strong credential management.

Most modern attacks don’t break in, they log in. A business-wide password manager, enforced multifactor authentication (MFA) on every account that matters, and the elimination of generic or default logins close off the easiest path an attacker has. Credentials are the new perimeter; treat them that way.

A minimised attack surface.

Management interfaces shouldn’t be reachable from the public internet. Unnecessary accounts and services should be turned off. Every door you don’t need is one you don’t have to defend.

Routine review of controls.

Security configurations drift over time as people change roles, projects launch, and systems are added. A regular review – confirming that the controls you put in place are still in place and still working – is what keeps a strong posture from quietly eroding.

None of these are exotic. That’s precisely the point. They reward consistency, not cleverness.

Why Operational Security Is Your Best Defence Against AI-Powered Attacks

In an environment where attackers move at machine speed, disciplined operational security may be your single most effective defence – paired with AI-assisted detection and response that can spot and contain trouble at the same pace threats are moving. One side reduces how much can go wrong; the other shortens how long it takes to catch what does.

But tools and tactics only go so far without one more ingredient: treating IT security as a core business competency, with genuine leadership support behind it. Threats like FortiBleed don’t reward the organisations that bought the most software. They reward the ones that operate well, every day – and that takes leadership deciding security is worth doing properly.

Strengthening Your Operational Security With Go West IT

Insisting that security be a core competency doesn’t mean building all of it in-house. The execution and the guidance can be entrusted to a partner who does this work every day – keeping firmware and software current, managing credentials and access, hardening your platforms, and reviewing your controls so nothing drifts.

That’s where Go West IT comes in: helping you put the right fundamentals in place, keep them running, and turn the next industry-wide scramble into a routine exercise.

The harder you work on the fundamentals, the luckier you’ll look when the next threat comes around. We’d be glad to help you do that work.

If you’d like to review where your organisation stands on operational security, we’re here.

Further reading: CISA, “CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure” (June 2026)

Frequently Asked Questions About Operational Security

What is operational security in IT?

Operational security (OpSec) in an IT context refers to the ongoing discipline of maintaining controls that protect a business’s systems, data, and network. This includes routine practices such as firmware and software patching, credential management, MFA enforcement, minimising the attack surface, and regularly auditing that existing controls are still working. Unlike a one-time security audit, operational security is a set of continuous habits – the consistent work that reduces risk before a threat materialises.

What does the FortiBleed vulnerability mean for my business?

FortiBleed refers to a wave of attacks exploiting previously disclosed vulnerabilities in Fortinet devices – particularly firewalls and VPN gateways – combined with leaked credentials. Attackers used AI to systematically test known exposures against live networks. If your business uses Fortinet or similar edge devices and has not applied recent firmware updates or rotated credentials following prior disclosures, it is worth reviewing your posture. CISA published guidance in June 2026 specifically urging organisations to harden Fortinet devices and review credential exposure.

What is the single most important step I can take to improve my business’s cybersecurity right now?

If you’re starting from scratch, enforcing multifactor authentication (MFA) across all key accounts – email, remote access, admin portals – delivers the most immediate reduction in risk. Most successful breaches involve compromised credentials; MFA closes off that path even when a password is known. From there, a structured firmware and patching schedule, combined with a regular review of who has access to what, will address the majority of the remaining exposure.

AI App Hosting for Businesses: Where Should Your AI-Built Applications Live?

Once a business starts using paid AI models like OpenAI or Anthropic’s Claude, something predictable happens. Someone – often not a developer by title – builds something. An app. An agent. A workflow that automates a task the team used to dread. And it works. It brings real, measurable value.

That’s the moment the ground shifts. Because in the age of capable AI, we’re all developers now – and AI app hosting is no longer a question just for technical teams. Deciding where your AI-built applications live, who controls them, and how they’re kept secure is a business decision. Getting the answer right early makes everything easier.

Why AI App Momentum Doesn’t Stop at One

Our experience at Go West IT is that once a business sees what’s possible, this doesn’t stay a one-time event. The first useful app inspires the second. A colleague sees it and builds their own. Within a few months, what started as one person’s experiment has become a small portfolio of tools the business is starting to rely on.

That’s really exciting, and it’s also where the important questions begin.

The Right Questions to Ask Before You Host AI Applications

As your team builds more, four questions quickly matter:

  • Where are these apps hosted and who is responsible for keeping them running?
  • Where does the code live, and who controls it if a key person leaves?
  • How do you manage access, is this internal only, or will clients interact with it?
  • How do you ship updates as the app evolves and improves?

These aren’t roadblocks. They’re the sign that something experimental is becoming something real. The businesses that answer them early turn a pile of promising experiments into durable, supportable assets.

How We Host AI-Built Apps at Go West IT: Our Azure Setup

We’re already well down this path internally, and we made a deliberate decision from the start: rather than scatter applications across personal accounts and consumer-grade tools, we’d build on a secure environment we already manage and trust.

In practice, that means:

Hosting in Azure. Our applications run in a managed cloud environment with redundancy, backups, and room to grow – not on someone’s laptop or a free-tier account that disappears when they change roles.

Identity and access through Microsoft Entra ID. Authentication and access management are handled consistently across our applications, so we always know who can reach what – whether the app is internal-only or touches client data.

Code managed in Azure DevOps. Our repositories live there, and we push code from DevOps straight to the application in Azure. That gives us version control, a documented change history, and a clean, repeatable way to ship updates.

The payoff is that as more applications surface – and they will – we’re not reinventing the approach each time. We have a repeatable, supportable process that protects three things at once: operational efficiency (we ship and maintain without chaos), intellectual property (the code your team creates is a business asset, governed like one), and operational security (access, hosting, and change management are controlled by design, not by accident).

How Much Does AI App Hosting Cost? Azure Pricing Explained

One of the most reassuring parts of this conversation is that the costs are knowable and modest relative to the value.

A basic application can run on an Azure Static Web App for approximately $9 per month. A more robust application – one that needs to run in a Linux container, for example – typically lands in the $100 to $200 per month range. Either way, you’re working with predictable monthly recurring costs you can plan around.

That predictability makes return on investment easy to evaluate. It also opens the door to a new metric worth tracking: Return on Tokens – how much did you spend, in AI usage and supporting infrastructure, to build and run that app, and is the value it returns worth it? That’s the difference between ‘we think this AI thing is helping’ and ‘we know exactly what this costs and what it returns.’

Building an AI App Hosting Strategy That Scales

If deciding whether your business is AI-ready was the first step, this is the natural next one: giving the things your team builds a secure, permanent, well-managed home – and a strategy that scales as the next app, and the one after that, arrives.

This is the path we’ve walked ourselves, which is exactly why we can guide you down it. Go West IT can help you stand up a secure hosting and development foundation – Azure for hosting, Entra for identity, Azure DevOps for code, so the value your team is creating with AI becomes something lasting, protected, and supportable.

You’re already building. Let’s make sure what you build has somewhere solid to stand.

If you’d like to talk through a hosting and development strategy for your AI-built applications, we’re here.

Frequently Asked Questions About AI App Hosting

What is the cheapest way to host an AI-built application?

A basic application can run on an Azure Static Web App for approximately $9 per month. This is suitable for lighter tools; internal dashboards, simple agents, or workflow automations that don’t require a dedicated server. More complex applications, such as those that need to run in a Linux container, typically cost $100 to $200 per month. Both options offer predictable monthly costs and enterprise-grade reliability.

What security considerations apply to AI app hosting?

Key areas to address include identity and access management (Microsoft Entra ID handles authentication and controls who can reach each application), code version control (Azure DevOps ensures a documented, repeatable deployment process), and data governance (knowing whether client data or internal data flows through each application and how it is stored and protected). Hosting on a managed cloud platform like Azure also provides redundancy and backup capabilities that consumer-grade tools do not.

What is ‘Return on Tokens’ in AI app development?

Return on Tokens is a metric for evaluating the value of an AI-built application against its actual running costs – including AI model usage fees and hosting infrastructure. It helps businesses move from “we think this is helping” to “we know exactly what this costs and what it returns,” making it easier to prioritize which applications are worth developing and maintaining.

5 Questions If Your Business Is AI-Ready

Is your business adopting AI strategically or are employees already using AI tools without clear policies, security controls, or oversight?

Artificial intelligence is no longer something businesses are “thinking about.”

It’s already here.

Employees are using AI tools to write emails, summarize meetings, analyze spreadsheets, generate marketing content, assist with coding, and automate repetitive work. In many organizations, AI adoption is happening faster than leadership realizes.

The challenge is not whether businesses should use AI.

The challenge is whether they are prepared to use it responsibly, securely, and strategically.

As we discussed in AI Conversations Are Accelerating Business Innovation But What Does That Mean for IT Security?, AI adoption is accelerating across nearly every industry. But moving quickly without clear guardrails can introduce operational, compliance, and cybersecurity risks businesses may not fully understand yet.

AI readiness is not about having all the answers.

It’s about asking the right questions early.

1. Who Owns AI Strategy Inside Your Organization?

One of the biggest mistakes businesses make with AI adoption is assuming it will “figure itself out.”

In reality, AI works best when someone is steering the process.  

That does not necessarily mean hiring a Chief AI Officer or building a dedicated AI department.

But businesses should identify:

  • Who evaluates AI tools
  • Who approves use cases
  • Who manages risk discussions
  • Who ensures policies are followed
  • Who measures business value

Without ownership, AI adoption often becomes fragmented.

Different teams begin using different tools independently, sensitive information may be exposed unintentionally, and businesses lose visibility into where AI is being used and why.

The goal is not to slow innovation down.

It’s to ensure adoption happens intentionally.

 

2. Do You Have an AI Use Policy?

Many businesses already have employees using AI tools without any formal guidance.

That creates significant risk.

According to Microsoft Work Trend Index1, employees are often adopting AI tools faster than organizations can establish governance around them.

An AI use policy helps define:

  • Which AI tools are approved
  • What types of data can be used
  • What information should never be entered into AI systems
  • Expectations around human review and accountability
  • Compliance considerations for regulated industries

As outlined in Go West IT’s AI Readiness guidance, organizations should explicitly prohibit employees from inputting confidential client data, financial information, personally identifiable information (PII), or protected health information into consumer-grade AI tools.  

This is especially important for industries like:

  • Financial services
  • Healthcare
  • Legal
  • Accounting
  • Professional services

A simple, readable policy is often more effective than a complicated one no one follows.

3. Are Your Existing Security Controls Ready for AI?

AI adoption introduces new types of security considerations.

Businesses often focus on productivity first and security second.

But AI tools interact with:

  • Cloud platforms
  • Internal documents
  • SaaS applications
  • Sensitive data
  • Identity systems
  • Business workflows

That means AI readiness is closely connected to cybersecurity readiness.

As we explored in Modern Security for the Distributed Workforce, businesses already operate across increasingly decentralized environments. AI expands that complexity further.

Organizations should evaluate whether they have:

  • Multifactor authentication (MFA)
  • Single sign-on (SSO)
  • Identity management controls
  • Data loss prevention policies
  • Endpoint visibility
  • Security monitoring
  • User access governance

Go West IT’s AI Readiness framework also recommends implementing technical guardrails such as SSO integration, input/output restrictions, and controlled AI access layers where appropriate.  

The question is not simply:
“Can employees use AI?”

The better question is:
“Can they use it safely?”

4. Is Your Team Trained to Use AI Responsibly?

AI literacy is quickly becoming a business necessity.

Many employees understand what AI tools can do.

Far fewer understand:

  • What AI should not be used for
  • How hallucinations occur
  • Why outputs require validation
  • How sensitive data may be exposed
  • What ethical concerns exist around AI-generated content

According to IBM AI Insights2, businesses are increasingly integrating AI into operational workflows, making employee understanding and oversight increasingly important.

Training helps close the gap between intention and behavior.

As outlined in Go West IT’s AI Readiness guidance, organizations should provide baseline AI literacy training and reinforce that AI is a productivity tool not an authority. Human review remains essential.  

This is not about fear.

It is about responsible adoption.

5. Are You Measuring Business Value or Just Experimenting?

AI adoption should ultimately support business outcomes.

That could include:

  • Improved efficiency
  • Faster response times
  • Reduced repetitive work
  • Better reporting
  • Operational automation
  • Improved customer experiences

But businesses should still ask:

  • What problem are we solving?
  • How will we measure value?
  • Is this tool improving productivity?
  • Are we reducing risk or introducing it?
  • Is adoption aligned with business goals?

As discussed in Will AI Agents Replace SaaS Applications?, AI is rapidly reshaping how businesses interact with software and workflows. But successful adoption requires intentional planning not random experimentation.

Go West IT’s own AI Readiness framework emphasizes revisiting AI initiatives regularly because the tools, risks, and opportunities evolve quickly.  

AI readiness is not a one-time project.

It’s an ongoing operational conversation.

AI Readiness Is Really About Operational Readiness

The businesses seeing the most success with AI are not necessarily the ones adopting tools the fastest.

They are the ones creating structure around adoption.

That includes:

  • Clear ownership
  • Practical policies
  • Security guardrails
  • Employee training
  • Strategic use-case evaluation

As we discussed in Why Small Businesses Need a Cybersecurity Framework, mature technology strategies are rarely built on isolated tools alone. They are built on structured processes, visibility, and governance.

AI is no different.

Final Thoughts

Most businesses are already exploring AI in some form.

The question is whether that adoption is happening intentionally.

AI readiness does not require perfection. It requires visibility, ownership, training, and thoughtful guardrails that align innovation with security and operational goals.

Because the businesses that benefit most from AI will not simply be the ones that adopt it first.

They will be the ones that adopt it responsibly.

If your organization is beginning to explore AI tools, workflows, or governance strategies, now is the time to start building the foundation for long-term success.

FAQs

1. What does it mean for a business to be AI-ready?

AI readiness means a business has the policies, ownership, security controls, and training needed to adopt AI tools responsibly and effectively.

2. Why do businesses need an AI use policy?

An AI use policy helps define approved tools, acceptable use, data handling expectations, and employee accountability to reduce operational and security risks.

3. What are the biggest AI risks for small businesses?

Common risks include data exposure, compliance issues, inaccurate outputs, shadow AI usage, identity security concerns, and lack of governance.

4. Should employees be trained on AI usage?

Yes. AI literacy training helps employees understand both the benefits and limitations of AI tools, including security, privacy, and ethical considerations.

5. Does AI readiness only apply to large companies?

No. Small and mid-sized businesses are rapidly adopting AI tools as well, making governance, security, and operational readiness important for organizations of all sizes

 

 

Sources:

https://www.ibm.com/think/topics/artificial-intelligence-business-use-cases

https://www.microsoft.com/en-us/worklab/work-trend-index/ai-at-work-is-here-now-comes-the-hard-part

 

Why Quarterly Penetration Testing Is No Longer Optional

How often should businesses test their network security to stay ahead of modern cyber threats?

For many organizations, penetration testing has traditionally been a once-a-year checkbox exercise.

But in today’s environment, that approach is no longer enough.

Your network changes constantly – new users, new devices, new configurations and attackers only need one overlooked vulnerability to gain access.

Quarterly penetration testing shifts security from a point-in-time assessment to an ongoing, measurable strategy.

What Is Network Penetration Testing?

Penetration testing simulates real-world cyberattacks to evaluate how your network would hold up under pressure.

Unlike basic scans, it goes a step further by:

  • Attempting safe exploitation of vulnerabilities
  • Mapping how far an attacker could move within your environment
  • Identifying real-world impact, not just theoretical risk

Go West IT’s approach combines both internal and external testing, using automated tools to simulate attacks from inside your network and from outside your perimeter. 

The result is a comprehensive understanding of:

  • Where vulnerabilities exist
  • How they could be exploited
  • What needs to be prioritized


Why Annual Testing Falls Short

A yearly penetration test may tell you where you stood 12 months ago.

But it doesn’t account for:

  • New vulnerabilities discovered daily
  • Software updates and configuration changes
  • Expanding attack surfaces from remote work and cloud adoption

As we explored in Why Vulnerability Management Is a Must, Not a Maybe, attackers often rely on known, unpatched weaknesses not sophisticated zero-day exploits.

This is why continuous visibility matters.

According to the Verizon Data Breach Investigations Report1, a large percentage of breaches involve the exploitation of known vulnerabilities, reinforcing the importance of identifying and addressing risks early.

Internal vs External Testing: Why Both Matter

Effective penetration testing doesn’t stop at the perimeter.

It evaluates two critical perspectives:

Internal Testing

Simulates what happens if an attacker gets inside your network.

This helps identify:

  • Lateral movement opportunities
  • Privilege escalation risks
  • Access to sensitive systems and data

External Testing

Simulates attacks from outside your organization.

This focuses on:

  • Firewalls and gateway defenses
  • Public-facing systems
  • Exposure to internet-based threats

Together, they provide a complete picture of your security posture not just isolated snapshots.


From Findings to Action: Prioritized Remediation

One of the biggest advantages of modern penetration testing is not just identifying vulnerabilities but prioritizing them effectively.

Each assessment delivers:

  • Severity-ranked findings
  • Executive summaries for leadership
  • Technical reports for IT teams
  • Clear remediation roadmaps

This aligns closely with principles outlined in Cyber Frameworks for Small Business Risk Management, where structured, prioritized approaches help organizations focus on the most critical risks first.

Measuring Progress Over Time

Security isn’t static and neither are your risks.

Quarterly testing introduces something most businesses lack:

Trend visibility.

With consistent testing, organizations can:

  • Track improvements over time
  • Measure the impact of remediation efforts
  • Identify recurring root causes (e.g., patching gaps, misconfigurations)
  • Demonstrate progress to leadership and stakeholders

This transforms security from a reactive function into a measurable business initiative.


The Cost-Effective Advantage of Automation

Traditional penetration testing can be:

  • Expensive
  • Infrequent
  • Resource-intensive

Modern automated solutions change that by providing:

  • Consistent quarterly testing
  • Faster turnaround times
  • Reduced reliance on manual red-team efforts
  • Scalable coverage across environments

According to the CrowdStrike Global Threat Report2, attackers increasingly exploit known vulnerabilities and misconfigurations, reinforcing the importance of identifying and addressing risks early.

In other words:

Testing more frequently isn’t just better security, it’s better business.

The Bigger Picture: Testing as a Core Security Layer

Penetration testing is not a standalone solution.

It works alongside:

  • Vulnerability scanning (to identify risks)
  • Detection and response tools (to monitor threats)
  • Frameworks (to guide strategy and governance)

As highlighted in Update on SASE: Modern Security for the Distributed Workforce, modern security must adapt to environments where users, devices, and applications operate beyond traditional network boundaries.

Testing ensures those environments remain secure, no matter where they exist.

Final Thoughts

Cybersecurity isn’t about hoping your defenses work.

It’s about proving they do.

Quarterly penetration testing gives you that proof, turning assumptions into validated insights and helping you stay ahead of evolving threats.

Because in today’s landscape, attackers don’t wait a year to find your weaknesses.

And neither should you.

If you’re ready to move from reactive security to continuous validation, learn more about our Penetration Testing services here.

FAQs

1. What is network penetration testing?

It is a simulated cyberattack designed to identify and evaluate exploitable vulnerabilities in your network.

2. Why is quarterly testing important?

Because your environment and threats evolve constantly, quarterly testing provides up-to-date insights and measurable progress.

3. What’s the difference between internal and external testing?

Internal testing simulates threats inside your network, while external testing evaluates perimeter defenses from outside.

4. Is penetration testing automated or manual?

Modern solutions often use automated tools for consistency and efficiency, combined with expert analysis.

5. Does penetration testing fix vulnerabilities?

No, it identifies and prioritizes them. Remediation is carried out based on the findings.

Sources:

  1. https://www.verizon.com/business/resources/reports/dbir/
  2. https://www.crowdstrike.com/global-threat-report/

Managed Detection & Response vs. Antivirus: What’s the Difference?

Managed Detection & Response vs. Antivirus: What’s the Difference?

Are your defenses preparing you for threats before they strike, or ready to respond effectively when they do?

For years, antivirus software was the go-to defense for business systems. It scanned files, flagged suspicious attachments, and blocked known malware. But in today’s fast-evolving cyber landscape, threats move quicker, target more broadly, and often slip through cracks that traditional antivirus (AV) can’t spot.

That’s where Managed Detection & Response (MDR) steps in as a critical layer of protection. MDR combines Endpoint Detection & Response (EDR) software with 24/7 monitoring by a Security Operations Center (SOC) team. It identifies unusual behavior that signals a breach in progress and enables rapid response to contain and mitigate the damage. While preventive tools aim to stop attacks before they happen, MDR focuses on detecting and responding during and after an incident, minimizing the fallout.

What Does “Left of Boom” Mean and Why It Matters

In cybersecurity, the terms “left of boom” and “right of boom” come from military strategy, adapted to describe the timeline of a cyber incident. “Left of boom” refers to everything that happens before a security breach occurs—proactive measures like prevention, hardening systems, and threat hunting to avoid incidents altogether. “Right of boom” covers everything after the initial compromise, including detection, containment, response, recovery, and learning from the event.

No business can stay entirely left of boom forever; breaches can and do happen despite the best prevention. That’s why a balanced approach is essential: strong left-of-boom protections to reduce risks, paired with robust right-of-boom capabilities to handle incidents when they occur. MDR excels on the right-of-boom side by providing real-time detection and expert response, helping businesses recover faster and with less damage.

“Luck is what happens when preparation meets opportunity.” – Seneca

This balanced mindset aligns with what we covered in Why EDR Is Essential for Cybersecurity in 2025, where detection and response bridge prevention and recovery. MDR elevates this by adding round-the-clock human expertise to manage those systems effectively.

Antivirus vs. EDR vs. MDR: Understanding the Evolution

Let’s break down these layers of defense and where they fit on the boom timeline:

Antivirus (AV): Primarily Left-of-Boom Protection

Traditional AV focuses on known signatures—viruses, malware, and trojans that have been identified and cataloged. It scans files, emails, and attachments against a database of threats. While it’s a solid preventive tool, it is not designed to stop new or evolving threats. AV is a left of boom prevention tool that blocks familiar dangers at the door.

Endpoint Detection & Response (EDR): Bridging Left and Right of Boom

EDR goes beyond signatures by analyzing system behavior to spot suspicious activity, like an unauthorized user escalating privileges or a process copying sensitive data. It provides visibility and alerts but often requires your team to investigate and respond. EDR supports left-of-boom efforts through ongoing monitoring and pairs with right-of-boom actions by enabling quicker detection during an attack.

Managed Detection & Response (MDR): Right-of-Boom Expertise

MDR builds on EDR by adding human intelligence from a dedicated team of cybersecurity professionals who monitor, investigate, and act in real time—24/7. If malicious behavior is detected, they can isolate devices, block threats, and contain the issue before it escalates. Unlike “set-and-forget” tools, MDR ensures your business has expert eyes on potential incidents around the clock, making it a powerhouse for right-of-boom response when attackers strike at any hour.

Why MDR Is Critical for Modern Businesses

The average breakout time for attackers—the window from initial compromise to spreading within your network—is now under 48 minutes, according to the CrowdStrike Global Threat Report. Relying only on left-of-boom tools like basic AV or periodic checks leaves small and medium-sized businesses vulnerable, especially without in-house IT teams available 24/7.

MDR addresses this by providing:

  • Detection of threats beyond known malware, including sophisticated attacks.
  • Response within minutes to contain and neutralize issues.
  • Access to seasoned analysts, bridging the skills gap for businesses without dedicated security staff.
  • Reduced downtime, data loss, and recovery costs through swift action.

MDR is an important control highlighted in frameworks like CIS Controls and NIST, which emphasize continuous monitoring, incident detection, and rapid response—key topics in our post Why Small Businesses Need the CIS Cybersecurity Framework.

Balancing Left and Right of Boom: A Comprehensive Defense

A complete cybersecurity strategy combines left-of-boom prevention (like AV and patching) with right-of-boom response (like MDR) to handle the full attack lifecycle:

  • Before (Left of Boom): Prevention through tools, policies, and awareness to stop threats from entering.
  • During and After (Right of Boom): Detection, containment, recovery, and forensics to limit damage and strengthen future defenses.

MDR doesn’t prevent every attack but ensures that when one occurs, the “blast radius” is minimized. It’s the difference between a quick recovery and a devastating breach.

Go West IT: Your Partner for Balanced Cyber Defense

At Go West IT, we help small and medium-sized businesses build layered protections that cover both left and right of boom. From preventive managed IT services to responsive MDR solutions tailored for industries like finance, law, and accounting, we scale security to fit your needs.

Ready to strengthen your defenses? Contact us for a free consultation or call 303-795-2200 (option 1).

FAQ

Does MDR replace antivirus? No—MDR complements AV by handling advanced threats and providing response capabilities that AV lacks. Together, they cover left and right of boom.

Is MDR expensive for small businesses? Not at all. Many providers, including us, offer scalable MDR options that deliver enterprise-level protection without breaking the bank.

How fast can MDR respond to a threat? Top MDR services respond within minutes of detection, isolating threats to prevent widespread damage.

What does “left of boom” mean? It refers to preventive actions before a cyber incident. “Right of boom” involves response and recovery after one starts.

How does MDR align with frameworks like CIS or NIST? MDR supports their recommendations for ongoing monitoring, threat detection, and quick incident response—core to right-of-boom effectiveness.

Sources

  • CrowdStrike Global Threat Report 2025

CISA – Managed Detection and Response

Why Vulnerability Management Is a Must, Not a Maybe

What happens when one unpatched system becomes your business’s weakest link?

In the world of cybersecurity, prevention starts long before an attack occurs. Threat actors don’t need to invent new exploits, they often take advantage of known vulnerabilities that haven’t been patched. This is where vulnerability management steps in: a continuous process of identifying, prioritizing, and remediating security weaknesses across your digital environment.

When done right, it transforms your IT operations from reactive firefighting to proactive protection.

What Is Vulnerability Management and Why It Matters More Than Ever

Vulnerability management is the ongoing process of scanning systems, assessing their exposure to threats, and applying fixes before attackers can exploit them. Unlike occasional patching, vulnerability management emphasizes continuous monitoring, criticality scoring (CVE prioritization), and structured remediation.

According to a 2025 study by IBM, 29% of breaches exploited unpatched vulnerabilities, a reminder that even well-intentioned IT teams can’t rely on manual patch cycles anymore [¹].

As we discussed in our earlier article, Software Patching Strategy for 2025: More Than Just Updates, patching is more than applying updates, it’s about staying one step ahead of evolving threats. Vulnerability management takes this further by ensuring that every component of your environment, from endpoints to edge devices, stays protected on an ongoing basis.

Three Areas You May Be Overlooking

1. Operating Systems

While Windows and macOS updates seem automatic, the reality is that failed or incomplete updates are common. Businesses should have a monitoring and remediation process to ensure patches actually apply. Missed OS patches can leave gaps for attackers to exploit within days of public disclosure.

2. Third-Party and Web Applications

Your browser extensions, PDF readers, and even accounting software can harbor vulnerabilities. As we noted in The Hidden Risks of Ignoring Firmware Updates, overlooked maintenance, whether in firmware or third-party tools, creates an open invitation for threat actors.

3. Network Edge Devices

Firewalls, routers, and switches often sit untouched after initial configuration. But these devices are prime targets for exploitation. Keeping network hardware firmware updated, combined with configuration audits, strengthens your perimeter defenses and supports compliance with frameworks like CIS and NIST, which we outlined in Why Small Businesses Need the CIS Cybersecurity Framework.

From Scheduled Patching to Continuous Management

The old way, quarterly patch windows, no longer cuts it. Today’s threat actors move faster than ever. In fact, CrowdStrike’s 2025 Global Threat Report found that the average breakout time for attackers dropped below 48 minutes [²].

That’s why continuous vulnerability management—supported by automation, CVE prioritization, and strong reporting—is essential. Businesses that adopt an ongoing approach significantly reduce their mean time to remediate (MTTR) and their overall exposure to known threats.

“An ounce of prevention is worth a pound of cure.”

— Benjamin Franklin

How Vulnerability Management Reduces Risk

  1. Identifies Hidden Weaknesses – Regular scans uncover risks across endpoints, servers, and cloud platforms.
  2. Prioritizes What Matters Most – CVE scoring and contextual threat intelligence focus efforts on the most critical vulnerabilities.
  3. Improves Patch Success Rates – Automated remediation reduces human error and downtime.
  4. Enhances Compliance – Demonstrates alignment with CIS, NIST, and other security frameworks.
  5. Builds Long-Term Resilience – Reduces the window of exposure, protecting your data, uptime, and reputation.


Go West IT: Your Partner in Risk Mitigation

At Go West IT, we help small and midsized businesses build structured, framework-aligned vulnerability management programs. From automated patching to CVE prioritization dashboards and managed monitoring, our team ensures that every “door” in your IT environment stays locked.

Learn how our vulnerability management and cybersecurity services can strengthen your defenses contact us for a free consultation or call 303-795-2200 (option 1).

FAQ

1. What’s the difference between patching and vulnerability management?

Patching is one action within a broader vulnerability management program, which also includes scanning, prioritizing, and validating remediation efforts.

2. What is CVE prioritization?

CVE (Common Vulnerabilities and Exposures) scoring helps rank vulnerabilities by severity, allowing IT teams to patch the most dangerous flaws first.

3. Does vulnerability management apply to small businesses?

Absolutely. Small businesses are frequent targets because they often lack the layered defenses that continuous vulnerability management provides.

4. What frameworks recommend vulnerability management?

Frameworks like CIS, NIST, and ISO 27001 all list vulnerability management as a core control for maintaining security and compliance.

Sources

  1. IBM Cost of a Data Breach Report 2025
  2. CrowdStrike Global Threat Report 2025
  3. CISA – Vulnerability Management Best Practices

CONTACT

Go West IT, Inc.
7951 E Maplewood Ave
Suite 260
Greenwood Village, CO 80111
Phone: 303.795.2200
Stay informed. Join Our Newsletter.

Subscribe

LATEST NEWS

The owner of this website has made a commitment to accessibility and inclusion, please report any problems that you encounter using the contact form on this website. This site uses the WP ADA Compliance Check plugin to enhance accessibility.