6 Months In: The Good, the Bad and the Ugly

Six months in. I gave an intern with no compliance background our hardest question, and eight days later he had 31 of 34 CyFun Basic controls audit-ready.

Stay calm. Patch often. Write it down.Tom Janssens, Founder

What CyFun actually is → https://easycyberprotection.com/learn/cyberfundamentals/what-is/

Wax On, Wax Off

Mr. Miyagi was right in The Karate Kid: the boring repetition is the whole point.

The security was there. The paperwork was not, and the paperwork is what fails audits.

• The platform: drafts the policies, pulls the evidence, flags what is missing.
• The human: still decides what those policies actually say.
• Us: we make the work fast. We do not make the judgment calls for you.

Why an MSP should offer compliance → https://easycyberprotection.com/learn/guides/why-msp-offer-compliance/

"Lower Than Yours, Apparently"

"What's your trust setting, TARS?" "Lower than yours, apparently." (Interstellar, and yes, ours is named after it.)

Once an issue, our in-house AI gets the floor, the same model that drafts your compliance policies, off the clock. I read all 25 issues so you would not have to. One complaint.

I'm Sorry, Dave. I'm Afraid I Can't Do That.

"I'm sorry, Dave. I'm afraid I can't do that." HAL 9000 said it ominously in 2001: A Space Odyssey. Mine says it when I am about to ship something dumb.

People ask how a near-solo shop ships this fast. The trick is not the AI; it is the feedback loops around it.

• Draft with Claude.
• Review with our own Cloudflare models (never ChatGPT).
• Human sign-off before anything ships.

I'll Be Back

"I'll be back." The Terminator meant it, and so does every attacker, usually through a door you forgot to lock.

We read all 25 issues so you do not have to.

• The back door beat the front door. A ticketing vendor, a hospital supplier, a booking system behind 100+ hotels. You inherit your suppliers' security.
• Ransomware went SME-shaped. The crews working Belgium target small firms on purpose. For a stretch this spring, a named Belgian victim almost every week.
• MFA bypass is the new frontier. The Tycoon 2FA service alone had around 500 Belgian victims before Europol shut it down.

What the back door usually leads to → https://easycyberprotection.com/learn/basics/ransomware/

Next Thursday: State Security, Breached Through the Back Door

Normal service resumes next week.

• Belgium's State Security breached through a supplier's flaw (the back door, live).
• A CCB patch roundup where one of the worst bugs sits inside an RMM (remote monitoring and management) tool that MSPs run themselves.
• The CCB's new "Fraudstop" emergency number for fraud and phishing, worth handing to clients.