The Caller Who Knew Your Books

The team car pulled alongside and offered a wheel change. Nobody checked who was driving.

The Limburg public prosecutor is warning Belgian companies about a vishing wave aimed straight at the finance desk: callers pose as support staff of the…

• Why it works: the caller names the exact platform the bookkeeper uses every morning, the one that manages accounts and payments across several banks. That detail buys instant credibility, and the "your money is leaving right now" pressure does the rest.
• What they ask: either transfer funds to a "safe" account, or install a remote-support tool so they can "secure" things for you. Both end the same way: the money goes abroad. Never install remote-access software for someone who called you.
• The defence is out-of-band verification: hang up, then call the platform or your bank back on the number from the contract or invoice, never a number the caller gives you. Real support does not cold-call you about pending transfers.

Security.NL: Belgian prosecutor warns company accountants → https://www.security.nl/posting/944629/Belgisch+OM+waarschuwt+voor+phishingaanvallen+op+boekhouders+bedrijven

Platform Spotlight: Know Your Starting Line

Every grand tour opens with a prologue: a short ride against the clock that shows exactly where everyone stands.

The CyFun nulmeting (baseline scan) now produces a client-ready deliverable: a branded report plus a phase-1 statement of work, in the client's own language.

• A facts-only, white-label report: built from live organisation data (connected integrations, scan-derived maturity, open findings). No effort estimates, no assumptions about paperwork the scan cannot see. Your logo, your client, your conversation.
• A phase-1 statement of work you control: the offer template comes pre-filled and stays MSP-editable: days times your day rate, plus your monthly fee. The platform proposes, you price.
• Trilingual, automatically: report and offer render in Dutch, French or English following the client organisation's language setting. One scan, the right paperwork for either side of the language border.

Try it in the demo → https://easycyberprotection.com/demo/

Patch Watch: Mother of All Patch Tuesdays

The queen stage: 570 climbs on the profile, two of them already attacking.

The July Patch Tuesday (14 July) is the largest Microsoft has ever shipped: 570 fixes (569 by the stricter CVE count), including 56 critical flaws and two…

• SharePoint CVE-2026-56164 (patch first): missing authentication lets a remote attacker gain elevated privileges over the network, no login needed. CISA (the US cyber agency) put it on its Known Exploited Vulnerabilities (KEV) list with a fix-by date of 17 July, which is tomorrow if you are reading this on publication day.
• ADFS CVE-2026-56155: a privilege-escalation flaw in Active Directory Federation Services, the single sign-on component. Actively exploited; KEV deadline 28 July.
• BitLocker CVE-2026-50661: a publicly disclosed bypass of Windows disk encryption. No exploitation confirmed yet, but the write-up is out, so treat stolen-laptop risk accordingly.

BleepingComputer on the record Patch Tuesday → https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/

#CyberLearn: What the Power Meter Says

Climbs are marketing. Watts are data.

New in the learn library: "CyFun Basic, by the numbers", one real, anonymised CyFun Basic implementation, measured instead of estimated.

• About 38 documents, roughly 7,000 words of policies and procedures, revised close to 950 times before they settled.
• 123 pieces of evidence across 11 types, tied to the 34 CyFun Basic controls by 294 links.
• About half the evidence was collected automatically, and the other half is the human part no tool can skip.
• The real finding: producing all that is only half the job. Knowing what is done, what is missing and what has gone stale is the other half, the half that never ends.

CyFun Basic, by the numbers: the full article → https://easycyberprotection.com/learn/cyberfundamentals/cyfun-basic-evidence-by-the-numbers/

T.A.R.S.: I Don't Do Phone Calls

Once an issue, our in-house AI gets the floor. T.A.R.S. drafts your compliance policies on the clock; this week we caught it answering the phone.

Caller:

Caller: Good afternoon, I am calling from your financial platform. We have detected suspicious transactions on your account. T.A.R.S.: Fascinating. I do not have a financial platform. I am one, arguably.