Tag Archive for: Managed IT Services

Operational Security Best Practices: How to Stay Protected in the Age of AI Attacks

There’s an old saying that it’s better to be lucky than good. When it comes to protecting your business from cyber threats, that’s a gamble worth retiring.

We prefer a different version: the harder you work, the luckier you get. In cybersecurity, the organisations that look lucky when a major threat makes the news are almost always the ones that invested in operational security best practices long before the headline appeared; unglamorous, consistent work that quietly removes risk before any alert is published.

How AI Has Changed the Cybersecurity Threat Landscape

AI has fundamentally changed the economics of a cyberattack. For years, the raw materials for a breach – old leaked credentials, previously disclosed vulnerabilities, forgotten accounts, unpatched devices – have been sitting in the open. What’s changed is that attackers can now use AI to comb through years of those exposures and test them against live networks at a speed and scale that simply wasn’t practical before.

The FortiBleed activity is a recent example. It wasn’t a single, novel zero-day. It was a systematic recycling of vulnerabilities and credential leaks that were already known and already disclosed – assembled by AI into a working attack against internet-accessible firewalls and VPN gateways. The materials were old. The method was new.

That pattern isn’t unique to one vendor or one product. It’s the shape of the modern threat landscape: the cost of patience has dropped to near zero for attackers, which means the margin for “we’ll get to it eventually” has narrowed considerably for everyone else.

Lucky or Prepared? The Real Difference in Cybersecurity

Here’s the encouraging part. For organisations that had been practising sound operational security, an event like FortiBleed wasn’t an emergency; it was a normal course of business. Review the controls, confirm everything was in order, and move on.

That isn’t luck. It’s the compounding return on consistent work. The teams that hadn’t done the work spent that same week in a fire drill. Same threat, very different week.

The difference comes down to a handful of disciplines that, done routinely, quietly remove most of the risk before any alert is published.

Operational Security Best Practices: The Fundamentals That Work

Operational security isn’t a product you buy. It’s a set of habits you keep. The ones that matter most:

Routine firmware updates.

The devices that run your network – firewalls, switches, access points – need firmware maintained on a schedule, not whenever someone remembers. Outdated firmware is one of the most common ways old vulnerabilities stay exploitable long after a fix exists. If your team discovered FortiBleed through the news rather than through a patch notification, that’s a gap worth closing.

Managed software patching.

Patching should run on a defined cadence and be verified, not assumed. “The update was available” and “the update is installed and the system rebooted” are very different things, and only one of them protects you.

Strong credential management.

Most modern attacks don’t break in, they log in. A business-wide password manager, enforced multifactor authentication (MFA) on every account that matters, and the elimination of generic or default logins close off the easiest path an attacker has. Credentials are the new perimeter; treat them that way.

A minimised attack surface.

Management interfaces shouldn’t be reachable from the public internet. Unnecessary accounts and services should be turned off. Every door you don’t need is one you don’t have to defend.

Routine review of controls.

Security configurations drift over time as people change roles, projects launch, and systems are added. A regular review – confirming that the controls you put in place are still in place and still working – is what keeps a strong posture from quietly eroding.

None of these are exotic. That’s precisely the point. They reward consistency, not cleverness.

Why Operational Security Is Your Best Defence Against AI-Powered Attacks

In an environment where attackers move at machine speed, disciplined operational security may be your single most effective defence – paired with AI-assisted detection and response that can spot and contain trouble at the same pace threats are moving. One side reduces how much can go wrong; the other shortens how long it takes to catch what does.

But tools and tactics only go so far without one more ingredient: treating IT security as a core business competency, with genuine leadership support behind it. Threats like FortiBleed don’t reward the organisations that bought the most software. They reward the ones that operate well, every day – and that takes leadership deciding security is worth doing properly.

Strengthening Your Operational Security With Go West IT

Insisting that security be a core competency doesn’t mean building all of it in-house. The execution and the guidance can be entrusted to a partner who does this work every day – keeping firmware and software current, managing credentials and access, hardening your platforms, and reviewing your controls so nothing drifts.

That’s where Go West IT comes in: helping you put the right fundamentals in place, keep them running, and turn the next industry-wide scramble into a routine exercise.

The harder you work on the fundamentals, the luckier you’ll look when the next threat comes around. We’d be glad to help you do that work.

If you’d like to review where your organisation stands on operational security, we’re here.

Further reading: CISA, “CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure” (June 2026)

Frequently Asked Questions About Operational Security

What is operational security in IT?

Operational security (OpSec) in an IT context refers to the ongoing discipline of maintaining controls that protect a business’s systems, data, and network. This includes routine practices such as firmware and software patching, credential management, MFA enforcement, minimising the attack surface, and regularly auditing that existing controls are still working. Unlike a one-time security audit, operational security is a set of continuous habits – the consistent work that reduces risk before a threat materialises.

What does the FortiBleed vulnerability mean for my business?

FortiBleed refers to a wave of attacks exploiting previously disclosed vulnerabilities in Fortinet devices – particularly firewalls and VPN gateways – combined with leaked credentials. Attackers used AI to systematically test known exposures against live networks. If your business uses Fortinet or similar edge devices and has not applied recent firmware updates or rotated credentials following prior disclosures, it is worth reviewing your posture. CISA published guidance in June 2026 specifically urging organisations to harden Fortinet devices and review credential exposure.

What is the single most important step I can take to improve my business’s cybersecurity right now?

If you’re starting from scratch, enforcing multifactor authentication (MFA) across all key accounts – email, remote access, admin portals – delivers the most immediate reduction in risk. Most successful breaches involve compromised credentials; MFA closes off that path even when a password is known. From there, a structured firmware and patching schedule, combined with a regular review of who has access to what, will address the majority of the remaining exposure.

AI App Hosting for Businesses: Where Should Your AI-Built Applications Live?

Once a business starts using paid AI models like OpenAI or Anthropic’s Claude, something predictable happens. Someone – often not a developer by title – builds something. An app. An agent. A workflow that automates a task the team used to dread. And it works. It brings real, measurable value.

That’s the moment the ground shifts. Because in the age of capable AI, we’re all developers now – and AI app hosting is no longer a question just for technical teams. Deciding where your AI-built applications live, who controls them, and how they’re kept secure is a business decision. Getting the answer right early makes everything easier.

Why AI App Momentum Doesn’t Stop at One

Our experience at Go West IT is that once a business sees what’s possible, this doesn’t stay a one-time event. The first useful app inspires the second. A colleague sees it and builds their own. Within a few months, what started as one person’s experiment has become a small portfolio of tools the business is starting to rely on.

That’s really exciting, and it’s also where the important questions begin.

The Right Questions to Ask Before You Host AI Applications

As your team builds more, four questions quickly matter:

  • Where are these apps hosted and who is responsible for keeping them running?
  • Where does the code live, and who controls it if a key person leaves?
  • How do you manage access, is this internal only, or will clients interact with it?
  • How do you ship updates as the app evolves and improves?

These aren’t roadblocks. They’re the sign that something experimental is becoming something real. The businesses that answer them early turn a pile of promising experiments into durable, supportable assets.

How We Host AI-Built Apps at Go West IT: Our Azure Setup

We’re already well down this path internally, and we made a deliberate decision from the start: rather than scatter applications across personal accounts and consumer-grade tools, we’d build on a secure environment we already manage and trust.

In practice, that means:

Hosting in Azure. Our applications run in a managed cloud environment with redundancy, backups, and room to grow – not on someone’s laptop or a free-tier account that disappears when they change roles.

Identity and access through Microsoft Entra ID. Authentication and access management are handled consistently across our applications, so we always know who can reach what – whether the app is internal-only or touches client data.

Code managed in Azure DevOps. Our repositories live there, and we push code from DevOps straight to the application in Azure. That gives us version control, a documented change history, and a clean, repeatable way to ship updates.

The payoff is that as more applications surface – and they will – we’re not reinventing the approach each time. We have a repeatable, supportable process that protects three things at once: operational efficiency (we ship and maintain without chaos), intellectual property (the code your team creates is a business asset, governed like one), and operational security (access, hosting, and change management are controlled by design, not by accident).

How Much Does AI App Hosting Cost? Azure Pricing Explained

One of the most reassuring parts of this conversation is that the costs are knowable and modest relative to the value.

A basic application can run on an Azure Static Web App for approximately $9 per month. A more robust application – one that needs to run in a Linux container, for example – typically lands in the $100 to $200 per month range. Either way, you’re working with predictable monthly recurring costs you can plan around.

That predictability makes return on investment easy to evaluate. It also opens the door to a new metric worth tracking: Return on Tokens – how much did you spend, in AI usage and supporting infrastructure, to build and run that app, and is the value it returns worth it? That’s the difference between ‘we think this AI thing is helping’ and ‘we know exactly what this costs and what it returns.’

Building an AI App Hosting Strategy That Scales

If deciding whether your business is AI-ready was the first step, this is the natural next one: giving the things your team builds a secure, permanent, well-managed home – and a strategy that scales as the next app, and the one after that, arrives.

This is the path we’ve walked ourselves, which is exactly why we can guide you down it. Go West IT can help you stand up a secure hosting and development foundation – Azure for hosting, Entra for identity, Azure DevOps for code, so the value your team is creating with AI becomes something lasting, protected, and supportable.

You’re already building. Let’s make sure what you build has somewhere solid to stand.

If you’d like to talk through a hosting and development strategy for your AI-built applications, we’re here.

Frequently Asked Questions About AI App Hosting

What is the cheapest way to host an AI-built application?

A basic application can run on an Azure Static Web App for approximately $9 per month. This is suitable for lighter tools; internal dashboards, simple agents, or workflow automations that don’t require a dedicated server. More complex applications, such as those that need to run in a Linux container, typically cost $100 to $200 per month. Both options offer predictable monthly costs and enterprise-grade reliability.

What security considerations apply to AI app hosting?

Key areas to address include identity and access management (Microsoft Entra ID handles authentication and controls who can reach each application), code version control (Azure DevOps ensures a documented, repeatable deployment process), and data governance (knowing whether client data or internal data flows through each application and how it is stored and protected). Hosting on a managed cloud platform like Azure also provides redundancy and backup capabilities that consumer-grade tools do not.

What is ‘Return on Tokens’ in AI app development?

Return on Tokens is a metric for evaluating the value of an AI-built application against its actual running costs – including AI model usage fees and hosting infrastructure. It helps businesses move from “we think this is helping” to “we know exactly what this costs and what it returns,” making it easier to prioritize which applications are worth developing and maintaining.

5 Questions If Your Business Is AI-Ready

Is your business adopting AI strategically or are employees already using AI tools without clear policies, security controls, or oversight?

Artificial intelligence is no longer something businesses are “thinking about.”

It’s already here.

Employees are using AI tools to write emails, summarize meetings, analyze spreadsheets, generate marketing content, assist with coding, and automate repetitive work. In many organizations, AI adoption is happening faster than leadership realizes.

The challenge is not whether businesses should use AI.

The challenge is whether they are prepared to use it responsibly, securely, and strategically.

As we discussed in AI Conversations Are Accelerating Business Innovation But What Does That Mean for IT Security?, AI adoption is accelerating across nearly every industry. But moving quickly without clear guardrails can introduce operational, compliance, and cybersecurity risks businesses may not fully understand yet.

AI readiness is not about having all the answers.

It’s about asking the right questions early.

1. Who Owns AI Strategy Inside Your Organization?

One of the biggest mistakes businesses make with AI adoption is assuming it will “figure itself out.”

In reality, AI works best when someone is steering the process.  

That does not necessarily mean hiring a Chief AI Officer or building a dedicated AI department.

But businesses should identify:

  • Who evaluates AI tools
  • Who approves use cases
  • Who manages risk discussions
  • Who ensures policies are followed
  • Who measures business value

Without ownership, AI adoption often becomes fragmented.

Different teams begin using different tools independently, sensitive information may be exposed unintentionally, and businesses lose visibility into where AI is being used and why.

The goal is not to slow innovation down.

It’s to ensure adoption happens intentionally.

 

2. Do You Have an AI Use Policy?

Many businesses already have employees using AI tools without any formal guidance.

That creates significant risk.

According to Microsoft Work Trend Index1, employees are often adopting AI tools faster than organizations can establish governance around them.

An AI use policy helps define:

  • Which AI tools are approved
  • What types of data can be used
  • What information should never be entered into AI systems
  • Expectations around human review and accountability
  • Compliance considerations for regulated industries

As outlined in Go West IT’s AI Readiness guidance, organizations should explicitly prohibit employees from inputting confidential client data, financial information, personally identifiable information (PII), or protected health information into consumer-grade AI tools.  

This is especially important for industries like:

  • Financial services
  • Healthcare
  • Legal
  • Accounting
  • Professional services

A simple, readable policy is often more effective than a complicated one no one follows.

3. Are Your Existing Security Controls Ready for AI?

AI adoption introduces new types of security considerations.

Businesses often focus on productivity first and security second.

But AI tools interact with:

  • Cloud platforms
  • Internal documents
  • SaaS applications
  • Sensitive data
  • Identity systems
  • Business workflows

That means AI readiness is closely connected to cybersecurity readiness.

As we explored in Modern Security for the Distributed Workforce, businesses already operate across increasingly decentralized environments. AI expands that complexity further.

Organizations should evaluate whether they have:

  • Multifactor authentication (MFA)
  • Single sign-on (SSO)
  • Identity management controls
  • Data loss prevention policies
  • Endpoint visibility
  • Security monitoring
  • User access governance

Go West IT’s AI Readiness framework also recommends implementing technical guardrails such as SSO integration, input/output restrictions, and controlled AI access layers where appropriate.  

The question is not simply:
“Can employees use AI?”

The better question is:
“Can they use it safely?”

4. Is Your Team Trained to Use AI Responsibly?

AI literacy is quickly becoming a business necessity.

Many employees understand what AI tools can do.

Far fewer understand:

  • What AI should not be used for
  • How hallucinations occur
  • Why outputs require validation
  • How sensitive data may be exposed
  • What ethical concerns exist around AI-generated content

According to IBM AI Insights2, businesses are increasingly integrating AI into operational workflows, making employee understanding and oversight increasingly important.

Training helps close the gap between intention and behavior.

As outlined in Go West IT’s AI Readiness guidance, organizations should provide baseline AI literacy training and reinforce that AI is a productivity tool not an authority. Human review remains essential.  

This is not about fear.

It is about responsible adoption.

5. Are You Measuring Business Value or Just Experimenting?

AI adoption should ultimately support business outcomes.

That could include:

  • Improved efficiency
  • Faster response times
  • Reduced repetitive work
  • Better reporting
  • Operational automation
  • Improved customer experiences

But businesses should still ask:

  • What problem are we solving?
  • How will we measure value?
  • Is this tool improving productivity?
  • Are we reducing risk or introducing it?
  • Is adoption aligned with business goals?

As discussed in Will AI Agents Replace SaaS Applications?, AI is rapidly reshaping how businesses interact with software and workflows. But successful adoption requires intentional planning not random experimentation.

Go West IT’s own AI Readiness framework emphasizes revisiting AI initiatives regularly because the tools, risks, and opportunities evolve quickly.  

AI readiness is not a one-time project.

It’s an ongoing operational conversation.

AI Readiness Is Really About Operational Readiness

The businesses seeing the most success with AI are not necessarily the ones adopting tools the fastest.

They are the ones creating structure around adoption.

That includes:

  • Clear ownership
  • Practical policies
  • Security guardrails
  • Employee training
  • Strategic use-case evaluation

As we discussed in Why Small Businesses Need a Cybersecurity Framework, mature technology strategies are rarely built on isolated tools alone. They are built on structured processes, visibility, and governance.

AI is no different.

Final Thoughts

Most businesses are already exploring AI in some form.

The question is whether that adoption is happening intentionally.

AI readiness does not require perfection. It requires visibility, ownership, training, and thoughtful guardrails that align innovation with security and operational goals.

Because the businesses that benefit most from AI will not simply be the ones that adopt it first.

They will be the ones that adopt it responsibly.

If your organization is beginning to explore AI tools, workflows, or governance strategies, now is the time to start building the foundation for long-term success.

FAQs

1. What does it mean for a business to be AI-ready?

AI readiness means a business has the policies, ownership, security controls, and training needed to adopt AI tools responsibly and effectively.

2. Why do businesses need an AI use policy?

An AI use policy helps define approved tools, acceptable use, data handling expectations, and employee accountability to reduce operational and security risks.

3. What are the biggest AI risks for small businesses?

Common risks include data exposure, compliance issues, inaccurate outputs, shadow AI usage, identity security concerns, and lack of governance.

4. Should employees be trained on AI usage?

Yes. AI literacy training helps employees understand both the benefits and limitations of AI tools, including security, privacy, and ethical considerations.

5. Does AI readiness only apply to large companies?

No. Small and mid-sized businesses are rapidly adopting AI tools as well, making governance, security, and operational readiness important for organizations of all sizes

 

 

Sources:

https://www.ibm.com/think/topics/artificial-intelligence-business-use-cases

https://www.microsoft.com/en-us/worklab/work-trend-index/ai-at-work-is-here-now-comes-the-hard-part

 

Why SIEM Is Becoming Important

Are cyber insurance companies starting to expect businesses to have advanced threat monitoring and security visibility tools in place?

Cyber insurance requirements are changing quickly.

What used to be limited to basic questions about antivirus software and backups has evolved into something far more comprehensive. Today, insurers increasingly want proof that businesses can actively detect, monitor, and respond to threats not just prevent them.

That shift is one reason Security Information and Event Management (SIEM) platforms are becoming a much bigger part of cybersecurity conversations for small and mid-sized businesses.

For many organizations, especially those in regulated industries or professional services, SIEM is no longer viewed as an enterprise-only tool. It’s becoming part of the modern security baseline.

What Is a SIEM?

SIEM stands for Security Information and Event Management.

At a high level, a SIEM platform collects and analyzes security-related activity across your IT environment in one centralized location.

This can include:

  • Login activity
  • Firewall events
  • Endpoint alerts
  • Microsoft 365 activity
  • Cloud application activity
  • Network anomalies
  • Suspicious authentication attempts
  • Security events across multiple devices and systems

Rather than forcing businesses to review dozens of disconnected logs manually, a SIEM helps consolidate visibility and identify patterns that may indicate malicious activity.

In practical terms, it helps answer questions like:

  • Is someone attempting to log in from another country?
  • Are failed login attempts increasing?
  • Did a compromised account suddenly access sensitive systems?
  • Is unusual activity happening after business hours?
  • Are security alerts across different systems connected?

As we discussed in Managed Detection & Response vs. Antivirus: What’s the Difference?, modern threats increasingly bypass traditional antivirus solutions entirely. Businesses need visibility into behavior and activity not just malware signatures.


Why Cyber Insurance Companies Care About SIEM

Cyber insurance providers have seen claim costs rise dramatically over the past several years, particularly from ransomware, business email compromise, and credential-based attacks.

As a result, underwriting requirements have become significantly stricter.

According to a report from IBM Security1, organizations that use AI and automation extensively in security operations reduced the average cost of a breach by millions compared to organizations without those capabilities.

At the same time, the CrowdStrike Global Threat Report2 highlights that attackers are moving faster than ever, with many modern attacks leveraging valid credentials, cloud platforms, and “malware-free” techniques that traditional defenses often miss.

This matters to insurers because businesses can no longer rely solely on prevention.

Insurance providers increasingly want to see evidence that organizations can:

  • Detect suspicious behavior quickly
  • Investigate security events
  • Correlate alerts across systems
  • Respond before damage escalates
  • Maintain visibility across cloud and remote environments

In other words:
It’s no longer just about whether an attack happens.

It’s about how quickly you can identify and contain it.

SIEM and the Rise of Identity-Based Attacks

One of the biggest drivers behind SIEM adoption is the rise of identity-focused attacks.

Modern attackers frequently target:

  • Microsoft 365 accounts
  • SaaS applications
  • VPN credentials
  • Single sign-on (SSO) systems
  • Cloud identities

As explored in Multi-Cloud Identity Management Simplified, businesses now operate across increasingly fragmented cloud environments, making centralized visibility far more important.

Threat actors are also becoming more difficult to detect.

The CrowdStrike 2026 Global Threat Report2 found that 82% of detections in 2025 were malware-free, meaning attackers increasingly relied on legitimate credentials and trusted tools instead of traditional malware.  

That means suspicious behavior often looks like “normal” activity unless businesses have tools capable of correlating and analyzing events across systems.

A SIEM helps bridge that gap.

SIEM Is About More Than Compliance

Some businesses still view SIEM purely as a compliance requirement.

But the bigger value is operational visibility.

A properly configured SIEM can help organizations:

  • Identify threats earlier
  • Reduce investigation time
  • Improve incident response
  • Strengthen audit readiness
  • Gain centralized reporting visibility
  • Support cybersecurity framework alignment
  • Reduce security blind spots

As we discussed in Cyber Frameworks for Small Business Risk Management, mature cybersecurity isn’t about buying random tools it’s about building layered visibility and structured processes.

SIEM supports exactly that.

Why SIEM Adoption Is Expanding Beyond Large Enterprises

One of the reasons SIEM adoption historically lagged in the SMB market was complexity.

Traditional SIEM platforms often required:

  • Significant infrastructure
  • Dedicated security teams
  • Complex integrations
  • Expensive licensing models tied to data volume

That model simply wasn’t practical for many growing businesses.

Modern SIEM solutions are changing that by making centralized visibility and threat monitoring more accessible and predictable for organizations that do not have enterprise-sized security teams.

At Go West IT, we are expanding our security offerings with a new SIEM platform designed specifically to help businesses gain greater visibility into their environments without the traditional operational overhead often associated with legacy SIEM deployments.

One of the biggest differentiators is simplicity, including a more predictable per-user pricing structure that aligns more naturally with how small and mid-sized businesses budget for IT and cybersecurity services.

The focus is not just on collecting logs, but on helping organizations:

  • Detect threats earlier
  • Improve visibility across systems
  • Strengthen cyber insurance readiness
  • Simplify security operations
  • Support proactive risk management

Learn more about the underlying SIEM platform technology here.

 

SIEM and Cybersecurity Insurance Readiness

Cyber insurance questionnaires increasingly ask about:

  • Endpoint detection and response (EDR)
  • Multifactor authentication (MFA)
  • Security monitoring
  • Log management
  • Incident response capabilities
  • Threat detection processes
  • Cloud security visibility

SIEM directly supports many of these areas.

In many cases, businesses pursuing cybersecurity insurance or attempting to maintain favorable coverage terms are discovering that stronger monitoring and centralized visibility are becoming expected components of a mature security posture.

As we discussed in Why Vulnerability Management Is a Must, Not a Maybe, visibility is foundational to proactive cybersecurity.

You cannot protect what you cannot see.

The Bigger Shift: From Prevention to Continuous Detection

Cybersecurity has fundamentally shifted over the past several years.

Businesses are no longer defending against only malware and isolated attacks.

Today’s threat landscape includes:

  • Credential theft
  • Cloud compromise
  • AI-assisted phishing
  • Remote workforce exposure
  • SaaS abuse
  • Supply chain attacks
  • Cross-platform lateral movement

That’s why cybersecurity strategies increasingly focus on:

  • Detection
  • Monitoring
  • Correlation
  • Response
  • Visibility

Not just prevention alone.

SIEM plays a central role in that evolution.

Final Thoughts

Cyber insurance companies are asking tougher questions because the threat landscape has changed.

Businesses are now expected to demonstrate not only that they have security tools in place, but that they can actively monitor, detect, and respond to threats across modern environments.

SIEM helps provide that visibility.

And as cybersecurity risks continue evolving, centralized monitoring and event correlation are quickly becoming essential components of a modern business security strategy not just enterprise luxuries.

If your organization is evaluating ways to improve security visibility, strengthen insurance readiness, and build a more proactive cybersecurity posture, now is the time to start the conversation.

FAQs

1. What does SIEM stand for?

SIEM stands for Security Information and Event Management, a platform that collects and analyzes security-related activity across an organization’s IT environment.

2. Why are cyber insurance companies asking about SIEM?

Because insurers increasingly want businesses to demonstrate they can detect, investigate, and respond to cyber threats quickly rather than relying only on preventative tools.

3. Is SIEM only for large enterprises?

No. Modern SIEM platforms are becoming more scalable and cost-effective, making them increasingly practical for small and mid-sized businesses.

4. What types of threats can SIEM help identify?

SIEM can help detect suspicious logins, unusual account activity, malware-related alerts, cloud security events, lateral movement, and other indicators of compromise.

5. Does SIEM replace antivirus or endpoint protection?

No. SIEM works alongside tools like antivirus, EDR, MFA, and vulnerability management by helping centralize visibility and correlate security events across systems.

 

 

Sources:

https://www.crowdstrike.com/en-us/global-threat-report

https://www.ibm.com/reports/data-breach

 

Why Quarterly Penetration Testing Is No Longer Optional

How often should businesses test their network security to stay ahead of modern cyber threats?

For many organizations, penetration testing has traditionally been a once-a-year checkbox exercise.

But in today’s environment, that approach is no longer enough.

Your network changes constantly – new users, new devices, new configurations and attackers only need one overlooked vulnerability to gain access.

Quarterly penetration testing shifts security from a point-in-time assessment to an ongoing, measurable strategy.

What Is Network Penetration Testing?

Penetration testing simulates real-world cyberattacks to evaluate how your network would hold up under pressure.

Unlike basic scans, it goes a step further by:

  • Attempting safe exploitation of vulnerabilities
  • Mapping how far an attacker could move within your environment
  • Identifying real-world impact, not just theoretical risk

Go West IT’s approach combines both internal and external testing, using automated tools to simulate attacks from inside your network and from outside your perimeter. 

The result is a comprehensive understanding of:

  • Where vulnerabilities exist
  • How they could be exploited
  • What needs to be prioritized


Why Annual Testing Falls Short

A yearly penetration test may tell you where you stood 12 months ago.

But it doesn’t account for:

  • New vulnerabilities discovered daily
  • Software updates and configuration changes
  • Expanding attack surfaces from remote work and cloud adoption

As we explored in Why Vulnerability Management Is a Must, Not a Maybe, attackers often rely on known, unpatched weaknesses not sophisticated zero-day exploits.

This is why continuous visibility matters.

According to the Verizon Data Breach Investigations Report1, a large percentage of breaches involve the exploitation of known vulnerabilities, reinforcing the importance of identifying and addressing risks early.

Internal vs External Testing: Why Both Matter

Effective penetration testing doesn’t stop at the perimeter.

It evaluates two critical perspectives:

Internal Testing

Simulates what happens if an attacker gets inside your network.

This helps identify:

  • Lateral movement opportunities
  • Privilege escalation risks
  • Access to sensitive systems and data

External Testing

Simulates attacks from outside your organization.

This focuses on:

  • Firewalls and gateway defenses
  • Public-facing systems
  • Exposure to internet-based threats

Together, they provide a complete picture of your security posture not just isolated snapshots.


From Findings to Action: Prioritized Remediation

One of the biggest advantages of modern penetration testing is not just identifying vulnerabilities but prioritizing them effectively.

Each assessment delivers:

  • Severity-ranked findings
  • Executive summaries for leadership
  • Technical reports for IT teams
  • Clear remediation roadmaps

This aligns closely with principles outlined in Cyber Frameworks for Small Business Risk Management, where structured, prioritized approaches help organizations focus on the most critical risks first.

Measuring Progress Over Time

Security isn’t static and neither are your risks.

Quarterly testing introduces something most businesses lack:

Trend visibility.

With consistent testing, organizations can:

  • Track improvements over time
  • Measure the impact of remediation efforts
  • Identify recurring root causes (e.g., patching gaps, misconfigurations)
  • Demonstrate progress to leadership and stakeholders

This transforms security from a reactive function into a measurable business initiative.


The Cost-Effective Advantage of Automation

Traditional penetration testing can be:

  • Expensive
  • Infrequent
  • Resource-intensive

Modern automated solutions change that by providing:

  • Consistent quarterly testing
  • Faster turnaround times
  • Reduced reliance on manual red-team efforts
  • Scalable coverage across environments

According to the CrowdStrike Global Threat Report2, attackers increasingly exploit known vulnerabilities and misconfigurations, reinforcing the importance of identifying and addressing risks early.

In other words:

Testing more frequently isn’t just better security, it’s better business.

The Bigger Picture: Testing as a Core Security Layer

Penetration testing is not a standalone solution.

It works alongside:

  • Vulnerability scanning (to identify risks)
  • Detection and response tools (to monitor threats)
  • Frameworks (to guide strategy and governance)

As highlighted in Update on SASE: Modern Security for the Distributed Workforce, modern security must adapt to environments where users, devices, and applications operate beyond traditional network boundaries.

Testing ensures those environments remain secure, no matter where they exist.

Final Thoughts

Cybersecurity isn’t about hoping your defenses work.

It’s about proving they do.

Quarterly penetration testing gives you that proof, turning assumptions into validated insights and helping you stay ahead of evolving threats.

Because in today’s landscape, attackers don’t wait a year to find your weaknesses.

And neither should you.

If you’re ready to move from reactive security to continuous validation, learn more about our Penetration Testing services here.

FAQs

1. What is network penetration testing?

It is a simulated cyberattack designed to identify and evaluate exploitable vulnerabilities in your network.

2. Why is quarterly testing important?

Because your environment and threats evolve constantly, quarterly testing provides up-to-date insights and measurable progress.

3. What’s the difference between internal and external testing?

Internal testing simulates threats inside your network, while external testing evaluates perimeter defenses from outside.

4. Is penetration testing automated or manual?

Modern solutions often use automated tools for consistency and efficiency, combined with expert analysis.

5. Does penetration testing fix vulnerabilities?

No, it identifies and prioritizes them. Remediation is carried out based on the findings.

Sources:

  1. https://www.verizon.com/business/resources/reports/dbir/
  2. https://www.crowdstrike.com/global-threat-report/

AI Conversations Are Accelerating Business Innovation But What Does That Mean for IT Security?

How can businesses adopt AI tools quickly without exposing themselves to security, compliance, and data risks?

AI tools were seen as experimental, something teams explored on the side.

Today, that has changed.

AI is now being used to:

  • Generate code
  • Build internal tools
  • Create customer-facing applications
  • Automate workflows and decision-making

What started as “this is interesting” has quickly become “we need to move faster.”

As we explored in Will AI Agents Replace SaaS Applications?, AI is no longer just a productivity layer, it’s actively reshaping how software is built and used across organizations.

But with that acceleration comes a critical question:

Are businesses securing what they’re building as fast as they’re building it?

The New Risk: Building Faster Than You Can Secure

AI-powered development tools like Claude, Copilot, and others are enabling teams to spin up applications, agents, and automations in record time.

But many organizations are:

  • Building outside of approved environments
  • Hosting applications in unsecured locations
  • Skipping identity and access controls
  • Lacking governance over what’s being created

This creates a new category of risk:

Unmanaged Innovation.

According to Microsoft1, AI is becoming deeply embedded in everyday workflows, which increases both productivity and the potential for data exposure and misuse if not properly governed.

Similarly, the National Institute of Standards and Technology2 (NIST) emphasizes that AI adoption must be paired with governance, visibility, and risk management to ensure secure implementation.

Where AI Development Needs to Be Secured

One of the biggest misconceptions is that AI tools themselves are the risk.

They’re not.

The risk lies in where and how the outputs are deployed.

If your team is:

  • Using AI tools like Claude to build applications
  • Creating internal tools or agents
  • Automating workflows with generated code

Those applications need to live in a secure, governed environment.

That means:

  • Hosting in controlled platforms (like Azure environments)
  • Using secure deployment methods (e.g., static web apps)
  • Enforcing authentication through systems like Entra ID
  • Ensuring applications are part of your broader infrastructure, not running independently

Without this, businesses risk creating shadow systems that:

  • Bypass security controls
  • Expose sensitive data
  • Operate without monitoring or oversight


Governance Can’t Be an Afterthought

The old approach to new technology was:

“Let’s test it, take it slow, and figure it out later.”

That no longer works.

Today, the reality is:

Move fast or be left behind.

But moving fast doesn’t mean moving ungoverned.

As discussed in Why Small Businesses Need a Cybersecurity Framework, frameworks like CIS exist to ensure that growth and security scale together, not separately.

AI adoption must include:

  • Defined policies on tool usage
  • Clear ownership of AI-generated applications
  • Approval processes for deployment
  • Ongoing monitoring and review

Because once an AI-built tool is in use, it becomes part of your attack surface.

The Role of a Security Partner in AI Adoption

This is where working with an actively engaged IT and cybersecurity partner becomes critical.

AI is evolving too quickly for static policies or reactive security approaches.

A modern IT partner helps:

  • Guide secure AI adoption from the ideation stage
  • Ensure applications are deployed in the right environments
  • Implement identity and access controls
  • Monitor and manage AI-driven systems as part of your infrastructure

As highlighted in Geopolitics and Cyber Threats: Why SMBs Are Now in Nation-State Crosshairs, today’s threat actors are more sophisticated, strategic, and opportunistic.

They don’t just target systems, they target:

  • Weak governance
  • Unmonitored applications
  • Gaps created by rapid innovation

The Shift: From “Can We Use AI?” to “How Do We Secure It?”

The conversation has changed.

It’s no longer:

  • Should we use AI?

It’s:

  • How do we use AI securely, at scale, and without increasing risk?

Businesses that succeed in 2026 and beyond will not be the ones that avoid AI.

They will be the ones that:

  • Adopt it quickly
  • Govern it effectively
  • Secure it intentionally


Final Thoughts

AI is accelerating everything from development and decision-making to innovation.

But it’s also accelerating risk.

Security can’t slow innovation but it must shape it.

Because in today’s environment, the biggest threat isn’t using AI.

It’s using it without control.

FAQs

1. Are AI tools like Copilot or Claude inherently risky?

No, but the way their outputs are used, deployed, and secured determines the risk.

2. Where should AI-generated applications be hosted?

In secure, governed environments like Azure, with proper authentication and monitoring in place.

3. What is “shadow AI” or unmanaged AI risk?

It refers to AI tools or applications being used or deployed outside of approved IT and security oversight.

4. Why is governance important for AI adoption?

Without governance, businesses risk data exposure, compliance issues, and unmonitored systems.

5. How can businesses adopt AI safely?

By working with an IT partner, implementing frameworks, securing deployments, and continuously monitoring usage.

Sources

  1. https://www.microsoft.com/en-us/security/blog/2026/01/29/new-microsoft-data-security-index-report-explores-secure-ai-adoption-to-protect-sensitive-data/
  2. https://www.nist.gov/itl/ai-risk-management-framework

Software Patching Strategy for 2025: More Than Just Updates

What is software patching?

Software patching is the process of applying updates to applications, operating systems, and firmware in order to fix security vulnerabilities, improve stability, and enhance performance. Think of it as preventive maintenance for your digital infrastructure. Just as you wouldn’t leave a broken lock on your office door, leaving software unpatched creates an open invitation for attackers.

Why is patching so critical for businesses in 2025?

In today’s threat landscape, patching has evolved from a simple IT task to a cornerstone of cybersecurity strategy. Attackers increasingly exploit vulnerabilities within days of disclosure. For small and mid-sized businesses, even one missed patch can lead to ransomware, data theft, or downtime that cripples operations.

The risks are real. As we noted in The Business Cost of Downtime: Planning for IT Resilience, the financial and reputational fallout of disruption far outweighs the effort of proactive patching.

What does a modern patching strategy include?

1. Prioritization based on risk

Not all patches are equal. Some fix minor bugs, while others close vulnerabilities already being weaponized. Businesses must prioritize updates by severity and potential impact. This is similar to the principles we discussed in The Hidden Risks of Ignoring Firmware Updates – overlooking “minor” updates can have major consequences.

2. Automation with oversight

Automated patch management tools reduce human error and keep systems current. But automation alone isn’t enough. Oversight through dashboards, reporting, and compliance checks ensures that critical updates don’t slip through the cracks.

3. Testing before deployment

While speed is important, so is stability. Smart businesses test updates in controlled environments before rolling them out across the organization to avoid interruptions to critical workflows.

4. Continuous monitoring and reporting

As Peter Drucker famously said:

“You can’t manage what you don’t measure.”

Monitoring patch compliance gives leaders visibility into where risks still exist. Reports highlight unpatched systems, helping businesses address gaps before they’re exploited.

5. Integration with resilience planning

Patching shouldn’t happen in isolation. When tied into business continuity plans and other safeguards like those we explored in Business Continuity & Backup in the Ransomware Era – – patching becomes part of a layered defense that helps organizations stay operational even when threats emerge.

What happens when patching is ignored?

History has shown that many major breaches trace back to unpatched systems. Delaying updates can expose businesses to avoidable risks, forcing them into reactive recovery mode, a far more expensive and disruptive approach.

From updates to strategy

Patching is no longer just about updates – it’s about strategy. A thoughtful approach to prioritization, automation, monitoring, and integration creates a security posture that is resilient, proactive, and aligned with broader business goals.

If you’re ready to move from patching as a checklist to patching as a strategy, contact Go West IT for a free consultation. Our experts can help you assess your current approach and build a roadmap for stronger cybersecurity in 2025 and beyond.

FAQ: Software Patching Strategy

1. What is software patching?

It’s the process of applying updates to fix security issues, bugs, and performance problems in software and systems.

2. Why is patching so important?

Unpatched systems are one of the easiest ways for attackers to get in. A single missed update can lead to a breach.

3. How often should businesses patch?

Critical patches should be applied as soon as possible. Routine updates are often done monthly or quarterly.

4. Does patching stop all cyber threats?

No. Patching prevents known vulnerabilities, but it works best alongside other defenses like firewalls, EDR, and phishing protection.

5. Who should handle patching?

It can be done by in-house IT teams or outsourced to a managed IT provider, as long as there’s a clear process and oversight.

How Much Should You Spend on Cybersecurity in 2026?

For most businesses, the honest answer is: more than you are right now.

In an era where cyberattacks are increasing in both sophistication and frequency, allocating a strong IT and cybersecurity budget isn’t a luxury — it’s a necessity.

If 2026 is the year you plan to get serious about securing your business, this is the time to set aside budget, define priorities, and create clear goals for IT investments.

Why Many Businesses Underfund Cybersecurity

Studies show that very few businesses are spending enough on cybersecurity to protect themselves against modern threats. While general IT maintenance often gets budgeted, proactive security measures — like advanced threat detection, phishing prevention, and policy enforcement — are frequently overlooked.

The result? Many organizations remain vulnerable to attacks that could have been prevented with better planning and investment.

Setting Priorities for Your 2026 IT Budget

When mapping out your IT spending for next year, focus on initiatives that deliver measurable improvements to your security posture. Some top priorities to consider include:

1. Endpoint Detection and Response (EDR)

Modern EDR tools continuously monitor devices for suspicious activity and respond in real time to contain threats — a must-have for defending against ransomware and zero-day attacks.

2. Hardening Your DMARC Policy

A strong DMARC policy helps prevent email spoofing, a common gateway for phishing attacks. Tightening these controls protects your brand’s reputation and reduces inbound threats.

3. Phishing Awareness and Training

Employees remain your most targeted attack vector. Simulated phishing campaigns and ongoing awareness training can dramatically reduce risky clicks and improve reporting rates.

4. Strong Password and Access Policies

Standalone passwords aren’t enough anymore. Adopting modern guidelines—like those outlined in our recent post on [New NIST Password Rules for Businesses]—can ensure you’re following best practices for usability and security. These include favoring long passphrases over complex combinations, limiting password reuse, and avoiding frequent forced resets 

5. Framework Alignment with a Trusted Provider

If you’re unsure where to start, consider working with a managed IT and cybersecurity provider to align with established frameworks like CIS Controls. This gives your business a clear roadmap for improving security across all systems.

Making IT Budgeting an Ongoing Process

Budgeting for IT security shouldn’t be a once-a-year scramble — it should be an ongoing strategic conversation.

Set quarterly check-ins to track progress toward your goals, reallocate funds if needed, and adapt to emerging threats.

Want to learn more about how to prioritize your IT investments? Explore our Managed Services Page for details on how we help businesses secure their operations.

FAQs: Budgeting for IT in 2026

How much should a small business spend on IT and cybersecurity?

While needs vary, many experts recommend dedicating 5–10% of your total revenue to IT, with a significant portion focused on security.

What’s the difference between IT budgeting and cybersecurity budgeting?

IT budgeting covers all technology expenses — hardware, software, cloud services, and support. Cybersecurity budgeting focuses specifically on tools, training, and processes that protect against threats.

Why is endpoint detection so important?

Endpoints (laptops, desktops, mobile devices) are the most common entry points for attackers. EDR tools detect suspicious behavior and respond quickly to stop breaches before they spread.

Is phishing training really worth the investment?

Yes — phishing is still the #1 cause of breaches. Training employees to recognize and report suspicious emails is one of the highest ROI cybersecurity investments.

What is CIS framework alignment?

The CIS Controls are a set of best practices for securing IT systems and data. Aligning with them ensures you’re following proven steps to protect against the most common threats.

Hidden Costs of Unused Cybersecurity Software

In the evolving landscape of cybersecurity, phishing remains one of the most persistent and damaging threats businesses face. To combat this, many organizations invest in software solutions to enhance their security posture. However, all too often, these tools are purchased as a “check-the-box” measure and left underutilized—or worse, completely unused. The result? Vulnerabilities persist, resources are wasted, and businesses remain exposed to the very risks they sought to mitigate.

The Problem with “Shelfware”

A common scenario: a company identifies phishing as a top concern and purchases an email filtering or endpoint detection and response (EDR) solution. Yet, the software is never fully set up, integrated into their systems, or managed effectively. It sits idle for years, offering no protection while silently draining budgets.

For example:

   • Phishing Prevention Tools: Businesses often invest in robust tools like email filtering solutions but fail to implement and monitor them correctly or run phishing campaigns to train employees.

   • Endpoint Detection and Response (EDR): Some companies run EDR software for years without proper configuration and more importantly monitoring, leaving systems vulnerable despite the illusion of security.

   • Incomplete IT Transitions: Organizations that start transitioning to new antivirus or other security platforms may abandon projects mid-way, leaving gaps in their defenses.

Why Managed Services Are the Solution

A managed service provider (MSP) like Go West IT solves this common issue by offering software, expertise, and execution in a single, comprehensive package. Here’s how partnering with an MSP delivers better outcomes:

  1. Cost Savings

MSPs often have access to enterprise-level pricing for software, meaning businesses can secure top-tier tools like Microsoft Defender, Azure Information Protection, CrowdStrike, Ironscales, and SaaSAlerts at lower costs. Consolidating software and services under one vendor eliminates the hidden costs of unused tools and duplicate solutions.

     2.    Full Integration

An MSP ensures that every tool—whether it’s an EDR platform or phishing prevention software—is fully set up, integrated with existing systems, and tailored to meet the organization’s unique security needs.  More importantly, it is aggressively monitored so important security events are dealt with in real time.

     3.    Ongoing Management

Cybersecurity is not a “set it and forget it” endeavor. MSPs provide continuous monitoring, updates, and management to ensure tools remain effective against evolving threats.

     4.    Improved Security Outcomes

With managed services, businesses benefit from expertly managed phishing campaigns, employee training, and proactive threat detection, ensuring comprehensive protection.

     5.    Streamlined Operations

Instead of juggling multiple vendors and tools, businesses work with one trusted partner who oversees every aspect of their security infrastructure.

Case Study: The Cost of Inaction

In one instance, a company purchased an EDR solution and ran it on their systems for five years without proper implementation. Not only were they paying for software that wasn’t protecting them, but their systems remained exposed to cyber threats during that entire period. A similar story is common with email filtering solutions like Mimecast—purchased but never leveraged to their full potential.

Had these businesses partnered with an MSP, they could have avoided wasted spend, mitigated risks, and achieved better results through a fully managed and optimized security solution.

Why Microsoft Solutions Matter

Microsoft offers a suite of security tools designed to address modern threats, particularly in email security. Solutions like Microsoft Defender for Office 365 provide advanced phishing protection, link detonation, and real-time monitoring, making them ideal for safeguarding against phishing attacks. When paired with MSP services, these tools can be fully leveraged to maximize both protection and value.

Make the Switch to Managed Services

Stop paying for unused or ineffective software. Partner with Go West IT to consolidate your cybersecurity tools, reduce costs, and ensure your defenses are always optimized. From phishing prevention to endpoint security, we bring the platform, expertise, and execution you need to stay ahead of threats.

Contact us today to learn more about managed services for your business!

Announcing Tom Hynek as President of Go West IT

August 1, 2022 – Go West IT is pleased to announce the promotion of Tom Hynek to the role of President. In this new role, Tom will oversee daily operations, service and product development, as well as facilitate continued collaboration and growth of the Go West IT team.

Since joining Go West IT in 2017, Tom has quickly advanced through positions with progressively more responsibility. He has demonstrated strong leadership skills, excellent character and is poised to guide Go West IT into this next phase.

“I’ve thoroughly enjoyed my first 5 years at Go West IT and I’m thankful for the opportunity to continue to watch our talented team evolve and seek out challenges in an ever-changing cybersecurity landscape,” said Hynek. “I’m proud to work with a team that truly lives and breathes our core values, while supporting and protecting our customers.”

Tom succeeds David Lewien, Go West IT’s founding President, who will shift into a new role as CEO, focusing on strategy and business development. David will remain deeply involved in stewarding Go West IT into the future.

“I am appreciative of what Tom has already done for Go West IT and excited for what he will bring as our President,”  said Lewien. “I look forward to continuing work as our CEO, shoulder to shoulder, with our leadership team to make Go West IT the very best MSP, period. This is an incredible group of people focused on empowering people, solving problems, and protecting livelihoods.”

At Go West IT, our mission is to guide customers through secure digital transformation by providing access to industry leading platforms and highly skilled technical resources. We succeed at this mission by embracing constant improvement, a willingness to tackle tough challenges, and caring about our people and customers.

With that, please join in congratulating Tom on this new role.

CONTACT

Go West IT, Inc.
7951 E Maplewood Ave
Suite 260
Greenwood Village, CO 80111
Phone: 303.795.2200
Stay informed. Join Our Newsletter.

Subscribe

LATEST NEWS

The owner of this website has made a commitment to accessibility and inclusion, please report any problems that you encounter using the contact form on this website. This site uses the WP ADA Compliance Check plugin to enhance accessibility.