Cybersecurity Blog

Nobody wakes up excited to switch IT providers. It feels like moving houses while the house is on fire: disruptive, risky, and easier to postpone one more quarter. So businesses stay in bad relationships for years, paying for service they resent, telling themselves the next provider might be worse. →

Cyber insurance renewals have a rhythm, and for a huge share of businesses that rhythm lands in the fourth quarter. It also collides with everything else in Q4: budget season, holidays, year-end closes. Which is exactly why so many renewals go badly. →

Most California business owners think of the CCPA as a website-cookie-banner law. As of January 1, 2026, it is also a cybersecurity law with teeth. New regulations from the California Privacy Protection Agency require certain businesses to conduct annual independent cybersecurity audits, run formal privacy risk assessments, and attest to the state, under penalty of perjury, that they did it. →

If you run a small investment adviser or fund in New York, you are living inside three overlapping cybersecurity rulebooks at once, and most firms your size only know about one of them. That gap is where enforcement actions come from. Here is the plain-English map: which rules actually apply to you, what they require in practice, and the control set that satisfies all of them at once. →

On July 13, 2026, the Department of War hit pause on the CMMC rollout. Phase 2, which was set to make third-party certification mandatory for most contracts involving Controlled Unclassified Information starting November 10, 2026, is suspended along with the later phases, pending a 60-day review whose guidance is expected around mid-September. →

First, the name. Microsoft Entra ID is what Azure Active Directory became, so if you have been searching "Azure AD P1 vs P2," you are in the right place; same product, new badge. Entra ID is the identity system behind every Microsoft 365 login your company makes, and since stolen logins are how most modern breaches start, the tier you license here is arguably the most consequential security decision in your whole Microsoft stack. →

Every Microsoft 365 mailbox comes with a baseline bodyguard called Exchange Online Protection, and it stops the obvious junk. The problem is that the attacks that actually cost businesses money, targeted phishing, impersonation, malicious links that turn bad after delivery, are built to walk right past that baseline. →

Orange County has a branding problem, and it works in its favor. Say the name and people picture beaches and theme parks. What they should picture is one of the most quietly formidable business economies in America: →

CyberDuo is expanding east. Beginning in July 2026, CyberDuo serves New York City with a dedicated local team, bringing its cybersecurity-first managed IT services model to the East Coast while deepening its Southern California core across Los Angeles, Orange County, and San Diego. →

In early 2024, a finance employee at the engineering firm Arup joined a video call with his company's CFO and several colleagues. Faces he knew, voices he knew. On that call, he was instructed to process a series of transfers, and he did, about $25 million worth. Every person on that video call except him was a deepfake. →

When people picture a hacker, they imagine someone in a hoodie personally rifling through their files. The reality is stranger and, honestly, more unsettling: your stolen data does not get read by one villain. It gets sold, packaged, resold, and industrialized by an underground economy that operates disturbingly like a normal marketplace, complete with vendors, bulk discounts, customer reviews, and even customer support. →

Here is the uncomfortable truth about breaches: they rarely announce themselves. The dramatic ransom note on every screen is the finale, not the opening act. Attackers typically live quietly inside a business network for weeks before doing visible damage, watching, collecting, and setting up. →

CyberDuo has earned the Microsoft Solutions Partner for Modern Work designation, Microsoft’s official recognition of partners who demonstrate proven capability in deploying, securing, and managing Microsoft 365 environments at scale. →

Every growing company in California eventually hits the same fork in the road. The technology has outgrown "the person who is good with computers," things are breaking more often, and someone in leadership finally asks the question: do we hire IT, outsource IT, or something in between? →

Los Angeles small businesses get quoted wildly different prices for "IT support," and the frustrating part is that the quotes are not describing the same thing. One provider says $60 a user, another says $200, and both call it managed IT. No wonder owners default to the cheapest number and find out later what was missing. →

Nobody publishes their prices in this industry, which is exactly why you are reading this. So let us do the thing IT providers usually avoid: put real numbers on the table for the Los Angeles market, explain what moves them up or down, and flag the tricks that make a cheap quote expensive. →

Plenty of industry awards exist, and frankly some are easier to get than others. What we like about this one is what it weighs. Cybersecurity is the first criterion on the list, not an afterthought, and that mirrors how we have operated since 2005: security first, with our own in-house 24/7 Security Operations Center behind every client, rather than security as an add-on product. →

Biotech founders are some of the smartest people you will ever meet, and many of them are running their company's entire IT and security on a shared admin password and a prayer. It is not a knock. When you are racing to hit a milestone before the next funding tranche, configuring conditional access policies is not exactly top of mind. But here is the uncomfortable reality: →

These two terms get used as if they mean the same thing, and they absolutely do not. Confusing them is how a business ends up paying for one when it needed the other, or proudly telling its cyber insurance carrier it "does penetration testing" when it actually just runs a scan. So let us clear it up once and for all, with an analogy that makes the difference obvious, and then sort out what your business actually needs. →

Take a breath. SOC 2 is very doable, especially the first time, if you understand what it actually is and stop trying to boil the ocean. Here is the no-panic guide to getting through it, from someone who has been on the other side of the audit. →