They did not break in. They signed in.
Once an attacker has a valid login, nothing on the endpoint objects and nothing in the firewall log looks wrong. Watching the identity itself is a separate job from watching the machine.
Blog
Notes on keeping a practice running.
Practical writing on IT, security and the things that actually take a dental practice or a small business offline. No vendor pitches.
The phishing that gets through is the phishing that looks like business
Microsoft 365 filtering catches the obvious. It does not reliably catch an invoice from a supplier whose own account was taken over, which is the attack that actually costs practices money.
Your cyber insurance form is a security audit, and you signed it
Cyber insurance applications quietly turned into control checklists with your signature underneath. Here is what they ask, what the answers mean, and why a hopeful yes is worse than a no.
The backup you have never restored from is not a backup
A backup job reporting success tells you a job ran. It does not tell you the data comes back. Three things separate a real recovery plan from a green tick in a dashboard.
Antivirus is not EDR, and the difference is the whole ballgame
Antivirus asks "have I seen this file before?" That question has a wrong answer every time an attack is new. Here is what endpoint detection and response does instead, and why it matters to a practice.