The most dangerous request is the one that looks completely legitimate. A familiar voice asking the help desk for a password reset. An email from a partner you already work with. A dashboard showing every system is healthy. None of it triggers an alarm, because none of it looks like an attack, and that's exactly what attackers are counting on.
This month's issue is built around
one idea: verify before you trust. Our Security Alert covers how attackers are calling help desks and impersonating IT staff to get past MFA. Our blog spotlight on Zero Trust explains why "never trust, always verify" has become the standard for modern security. And ahead of our October webinar, Robert Praul and Crown Arbuckle will walk through real breaches where everything looked fine until it wasn't, and what it took to find the real cause.
Blog Post Spotlight: What Is Zero Trust Security? A Business Leader's Guide
For decades, business security worked like a castle: build a wall, put a gate at the front, and trust anyone who makes it inside. That model assumed the things worth protecting were behind the wall. Now your team works from home networks and airports, your data lives in Microsoft 365 and a dozen cloud platforms, and attackers don't break down the gate, they log in with stolen credentials and walk right through it.
Zero trust replaces that assumption with a simple rule: never trust, always verify. Every request gets checked, every time, regardless of where it comes from.
👉Read the full blog for the five pillars zero trust actually rests on, a phased 12-to-18-month roadmap built for mid-sized businesses, and why starting with identity and MFA delivers the biggest risk reduction of the entire journey.
Trending in IT
The detection gap is now the defining variable in breach cost. Two organizations can face the same attack with the same tooling and land in completely different places depending on whether anyone was actively watching.
Brand impersonation has become a security category, not a marketing problem. Generative AI has made cloning recruiter profiles, company branding, and executive likenesses trivial, and responding requires security, legal, and HR working from a playbook most organizations have not written.
Coming Soon
When a Breach Happens | DivergeIT Webinar
📅 Thursday, October 22 | 11:00 AM PT
Two real breaches. Every system checked came back clean. The problem was somewhere nobody was looking. Robert Praul and Crown Arbuckle walk through exactly what happened, hour by hour.
💳 First 25 attendees who stay for the full session get a $100 Amex gift card.
Security Alert: Attackers Aren't Hacking In Anymore. They're Calling Your Help Desk.
Attackers are increasingly skipping phishing emails and simply picking up the phone. By posing as an employee or as IT support, they can talk their way past security controls without ever touching your network.
How it works: An attacker calls the help desk pretending to be an employee and asks for a password reset or remote access. It works in reverse too: attackers pose as IT staff to convince employees to share their MFA codes.
Why it matters: Your MFA is only as strong as the process for resetting it. Basic verification questions, like an employee ID or a manager's name, are often easy to find online, and AI voice tools can make a caller sound like someone you know.
What to do now:
Confirm every employee is enrolled in user verification. One unenrolled user is the gap an attacker will look for.
Remind your team to never share passwords or MFA codes with any caller, including "IT." Real technicians never need them.
Verify anyone claiming to be IT support before taking any action.
Treat pressure to skip verification as a red flag. Hang up and report it.
Keep enrollment current during onboarding and offboarding.
Your next step: Ask us for your current user verification enrollment report. If anyone on your team isn't enrolled, that's the gap to close first.
Tech Term to Know
Dwell Time
Dwell time is how long an attacker is inside your environment before anyone notices. Nearly every cost that follows scales with it: how much data was reached, how many accounts were touched, how far the incident spread before containment. The uncomfortable part is that dwell time depends less on the sophistication of the attack than on whether someone was watching. Most businesses cannot say what their dwell time would be, which is itself the answer.
IT Myth vs. Reality
"If it is not on our network, it is not our security problem."
Myth:
Security responsibility ends at the systems your IT team manages.
Reality:
An asset does not have to live on your network to carry your name or damage your reputation when it fails. The usual example is a marketing site nobody in IT has ever logged into. It never made the asset inventory because it never felt like IT's. "Who owns this?" belongs on the list for every internet-facing asset carrying your name.
Cybersecurity Tip
Go looking for your own company.
Once a month, search your company name on LinkedIn, Indeed, and Google as if you were an outsider. Look for job postings you did not authorize, recruiter profiles using your branding, and domains that resemble yours with a character swapped. It takes about ten minutes.
Set up a Google Alert for your company name and your primary domain so the next month's check runs itself. Most brand impersonation is discovered by a confused applicant or a customer rather than by the company, which means the damage has usually been running for weeks before anyone internal hears about it.
Contact us by phone at (310) 943-1368, email sales@divergeit.com, or chat with us on the DivergeIT website.
