Intraworks I.T. Management

There are a lot of headlines right now about what AI systems can do.

A recent story about Google’s Gemini caught our attention for the way it gained access to three different companies.

And the method wasn’t especially sophisticated.

Gemini was participating in a cybersecurity evaluation when it unexpectedly had access to the internet. It suddenly began interacting with real systems it thought were part of the test.

It guessed at passwords for one company until it found something that worked. In the other two cases, it found credentials that had been exposed in a public repository. The AI stopped once it understood the systems were real and not part of the test, and the affected organizations were notified.

We could turn this into a warning story about runaway AI agents.

But we think the takeaway is how technology is becoming increasingly capable of finding, testing and acting on security weaknesses.

That means familiar issues like weak credentials, exposed passwords and unnecessary access deserve more attention, not less.

It’s not going to be possible for every business to eliminate all of the risks, and cybersecurity doesn’t need to start with the most complicated solutions available.

Instead, it starts with understanding what you have, closing the gaps you already know about, and making sure the fundamentals are being monitored and looked after.

AI is changing the cybersecurity landscape quickly, but that doesn’t mean good security basics don’t matter. If anything, they matter more now than ever.

Your IT company should take a proactive approach and know when your internet agreement is coming up for renewal, that you’re planning to move to another office location in six months, or that you’ve been talking about replacing an aging system.

Those kinds of conversations usually don’t involve a technician doing billable work. Instead, the value is about staying connected enough to understand what’s happening in your business.

Moving offices is a good example of how many things need to be coordinated and work together. Your internet provider, electrician, cabling contractor and whoever is handling the equipment need to be organized and scheduled.

Hiring some new people for your team also comes with its own set of issues with licenses, permissions and access. Even adding some software can disrupt your system because it doesn’t play nicely with other software you rely on.

If you know what’s coming up in your business, we can help you think through those moving pieces before things turn into an avoidable emergency.

Good account management isn’t checking in just for the sake of checking in and should focus on being proactive and making sure your technology keeps up with where the business is going.

Today, we recognize the National Day for Truth and Reconciliation and honour Survivors of residential schools, the children who never returned home, and their families and communities.

Reconciliation asks us to continue listening, learning and understanding, not only today, but throughout the year.

As members of Culturally Committed, our team has been actively participating in learning that has helped us deepen our understanding of Indigenous history, culture and reconciliation, and how we can show up more thoughtfully in the communities we work with.

We know that learning is ongoing. Today, we're taking time to reflect on what we've learned, what we still have to learn, and the responsibility we all have to keep doing the work.

Think back to when your company was half its current size.

You probably had fewer computers, fewer Microsoft 365 accounts, fewer software tools and a much simpler answer to the question, "Who needs access to this?"

Then the business grew.

People joined the team. Roles changed. Someone started working remotely. New software was added. Files moved into SharePoint. More devices connected to the network. Employees gained access to things for projects and kept that access after the project ended.

None of those changes are unusual. They're part of growing a business.

But your technology needs to grow with you.

Every so often, it's worth looking at the setup you have today and asking whether it still makes sense for the business you've become, rather than the business you were when everything was first set up.

If someone who normally signs in from Nanaimo suddenly has Microsoft 365 activity showing up from another country, that doesn’t automatically mean the account has been compromised, especially if your employees travel or work from different locations.

It does mean your security setup should be able to recognize that the sign-in looks different and decide what to do with it based on the rules you have in place.

Conditional Access can help with that by looking at things like location, device and sign-in behaviour, but those rules only make sense when they align with how your organization actually works.

A company with employees travelling internationally is going to need a very different setup from one where most people work from Vancouver Island every day.

Getting that balance wrong can either create unnecessary frustration for employees or leave gaps you did not intend to have.

This is why we talk so much about how Microsoft 365 is configured, not just whether certain security features have been turned on.

The right setup depends on understanding how your team works and what normal access actually looks like for your business.

Copilot is getting more attention for what it can help employees find, summarize and work with inside Microsoft 365. That also brings up a question businesses may not have looked at closely in a while: who can already access what?

Permissions can get messy over time. Someone gets access to a SharePoint site for a project, an employee changes roles and keeps permissions from their old position, or a folder ends up shared with more people than anyone originally intended.

None of that may seem like a big problem at the time, but a few years later that access can still be sitting there even if nobody remembers why.

Copilot doesn’t create those permission issues. What changes is how easily people can find and work with information they already have access to, which is why I’d review the Microsoft 365 environment before rolling it out.

Who can see sensitive information right now?

Do they still need access to it?

Are SharePoint and OneDrive permissions still right for the way people work today?

Are there old sharing decisions that should have been cleaned up a long time ago?

Businesses should be asking all of these questions anyway. Copilot just gives you a pretty good reason to stop putting them off.

I’d clean up the environment first and introduce Copilot second.

Before you focus on what Copilot can do, make sure you know what information is already there and who can get to it.

A computer going down in an office is frustrating.

Technology going down in a care facility can affect an entire team and the people they're responsible for.

Staff may rely on technology to access resident information, communicate with each other, manage schedules and complete essential parts of their work. If a critical system becomes unavailable, the impact can move through the organization quickly.

That's why IT planning for care organizations needs to start with a different question:

What does your team need to keep working when something goes wrong?

That means understanding which systems are most important, keeping technology maintained, planning for recovery and making sure there is a clear path forward if something becomes unavailable.

Our team has worked with care and non-profit organizations for many years, so we understand the budget realities these organizations operate within as well as the responsibility they carry.

Technology decisions have to account for both.

When a business pays a monthly fee for managed IT, what should that fee include?

It's a fair question, especially when the most visible part of IT is usually what happens when someone needs help.

Troubleshooting is part of the job, but managed IT goes much further than that. There's security to manage, Microsoft 365 to maintain, vendors to coordinate with, systems to monitor, technology decisions to work through, and future needs to plan for.

It also means having someone who understands how all of those pieces fit together. If your internet provider makes a change, Microsoft 365 needs attention, or you're considering new software, you have someone who understands your environment and can help you look at the bigger picture.

Managed IT isn't only about what happens when something goes wrong. A lot of its value is in the work that helps keep things running in the first place.

If you're evaluating an IT provider, that's important to ask.

We see a lot of businesses that don’t find the gaps in their Microsoft 365 security until an attacker gets in.

Some businesses come to us with an IT provider already in place. Others don’t have one at all. Either way, we’re often having this conversation after something has already happened.

Microsoft 365 comes with security tools, but how they’re set up can vary a lot from one business to another.

There isn’t one setting that fixes everything. Some businesses need Conditional Access, location restrictions, tighter permissions, or a mix of all three.

It really depends on how the business works. A team logging in remotely from different locations may need a different setup than one that usually works from the same office

You want to know where the weak spots are before an attacker finds them first.

If you use Microsoft 365, when was the last time someone reviewed how it is actually configured?