Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Generador de emergencia en contenedor junto a un edificio de noche con la entrada iluminada
10 min read

Four of more than eight hundred recoveries came close to the RTO they had written down

The first annual report from a firm that does nothing but recover attacked companies gives an uncomfortable number: out of more than eight hundred engagements, four came close to the 24-to-48-hour objective the company itself had documented, and none reached full operational capacity until weeks later. The cause is not the backup. A fifth of the first 48 hours goes into standing up a single healthy authentication source, 99.2% of clients arrive with no written plan for that, and 38% of the backups that survived the attack intact still could not carry the recovery. The two columns — what gets declared in surveys and what gets found in the field —, why a well-written continuity plan can be measuring the wrong thing, and the six lines we ask for before discussing RTO with anybody.

Continuity Disaster recovery Identity
Read more →
Sala de reuniones vacía de oficina con mesa larga, sillas y una pizarra de cristal casi borrada
8 min read

The retention that covered Copilot switches off this month, and nobody touched the policy

Between late October and mid-November 2026, Microsoft converts legacy Teams retention policies into "Teams-only" policies. If one of yours also kept Copilot conversations — and many did without anyone asking, because they shared the same plumbing — it stops. The notice is MC1481313, dated 28 September, and it does not name a single one of your policies. Where there used to be one checkbox there are now eleven AI apps to configure one by one, ChatGPT, Gemini and DeepSeek among them. With an inventory of the six retention clocks in Microsoft 365 and their official deadlines, the line in the documentation where an unpaid invoice outranks a legal hold, and six checks to run before mid-November.

Microsoft 365 Backup Compliance
Read more →
Pasillo de estanterías compactas de archivo, cerradas, con sus manivelas de accionamiento
9 min read

The advisory came 47 days late and your logs last 30

On 15 October BeyondTrust published CVE-2026-102764, a critical flaw in its remote support product that an espionage group had been exploiting since 29 August: 47 days of head start. CISA added it to the known exploited vulnerabilities catalogue on the 16th and gave federal agencies a deadline of today, 19 October. Patching is the easy half; the other half is the day-48 question — were we in it? — and the patch does not answer it, what answers it is what you decided months ago about log retention. With Entra ID defaults (7 days on Free, 30 on P1 and P2) and Defender XDR's 30 days of raw data, 29 August no longer exists in your identity log or your EDR. And Microsoft's own documentation says it plainly: retention is not retroactive.

Cybersecurity Compliance Monitoring
Read more →
Una silla vacía retirada de una mesa de madera con un portátil entreabierto y un ratón encima
9 min read

You can now change a meeting organizer; in a shared mailbox, you cannot

Microsoft is rolling out right now the thing every Microsoft 365 admin has been asking for: handing a meeting over to someone else without cancelling it. It arrives enabled by default, with no tenant configuration, and it does not work in classic Outlook for Windows. The real problem is elsewhere: the case that made you want this feature — the weekly meeting of the person who left — is exactly the one Microsoft's own offboarding procedure rules out, because its step 4 converts the mailbox to shared, and meetings in a shared mailbox are not eligible. And that same step 4 still tells you to cancel them all.

Microsoft 365 Workplace Exchange
Read more →
Parte trasera de un armario con servidores y latiguillos de red azules y verdes
9 min read

They broke into a fully patched appliance and went for the recovery keys

On 13 October, Volexity published its analysis of a fully patched remote access appliance on which someone gained unauthenticated root. The interesting part is not the bug: it is that no backdoor was left behind, that the vendor's integrity checker detects nothing because it all happens in memory, and that what they went looking for inside were LAPS passwords and BitLocker recovery keys. Your continuity plan is written against deletion, and here nobody deleted anything.

Cybersecurity VPN Continuity
Read more →
Estantería de archivo con cajas de documentos numeradas y atadas con cinta de tela
9 min read

SharePoint breaks the "Specific people" link, not the "Anyone" link

During October 2026 Microsoft is retiring SharePoint Online one-time passcode authentication in commercial tenants. You cannot pick the date, you cannot opt out, and it cannot be scoped per site. What stops opening is the named link, the one that made you type the recipient's address; the "Anyone with the link" one carries on unchanged. And the report Microsoft points you to in order to find who you are about to lock out excludes, in writing, links that were emailed and never clicked. What to check, what the EnableAzureADB2BIntegration setting no longer means, and why the right fix is not resharing in bulk.

Microsoft 365 SharePoint Identity
Read more →
Sala con filas de puestos de trabajo idénticos, mamparas bajas y sillas vacías
12 min read

Microsoft retires Targeted Release: your test ring is now paid for by everyone else

On 7 October 2026 Microsoft published advisory MC1490899 and updated three documentation pages the same day: Targeted release retires in January 2027 and from November 2026 its list can no longer be touched. The coverage reads it as a rename to Standard and Deferred. It is not. Reading the three pages together yields something else: to keep a validation group that runs ahead, Microsoft's own recommendation is not to move the pilot forward but to hold everyone else back by thirty days. Inside: the official mapping table read backwards, the documented cap of 100 users where each member of a security group counts one by one, the two kinds of change Deferred does NOT delay, and the seven checks that fit in half an hour before 31 October.

Microsoft 365 Workplace Compliance
Read more →
Pasillo entre armarios de servidores con las puertas cerradas en un centro de datos
9 min read

VCF hardening: the P0 shuts the door and the P2 leaves you the key

On 5 October 2026 VMware published its security configuration guidance for VMware Cloud Foundation. We downloaded the 9.1 spreadsheet and counted: 260 controls, 160 of them without the secure value set out of the box. Inside: why the control that shuts off host access is a P0 while the one that leaves you a recovery path is a P2, which virtual switch setting ships open on only one kind of switch, and the lines where the guide itself says what it does not do.

VMware Cybersecurity Virtualization
Read more →
Interior de una librería de cintas con el mecanismo del lector a la vista y una columna de ranuras vacías al fondo
9 min read

Microsoft deleted data before the window closed, and cannot say which

In late September 2026 it emerged that Microsoft, "due to an error", deleted data from expired subscriptions under its nonprofit programme before the retention and export window had closed. It could not be recovered. And there is a second half: it is currently unable to hand over a list of which data may have been deleted. Inside: the official Microsoft 365 countdown —30 days of Expired plus 90 of Disabled— and its asterisk; the 30 days that counter lost on 9 February 2026 for anyone buying direct under a Microsoft Customer Agreement; the four documented shortcuts that zero it, including the immediate deletion of SharePoint and OneDrive; and why article 33(5) of the GDPR asks you to document facts that, without an independent copy, you cannot enumerate.

Backup Microsoft 365 Compliance
Read more →
Archivo compacto de oficina con los paneles cerrados y las manivelas de apertura alineadas
9 min read

DLP alerts leave the queue on 12 October: the table they land in may be empty

On 12 October a built-in rule turns itself on and converts Purview DLP alerts into "behaviors": they stop raising alerts and stop entering the Defender XDR incident queue. Inside: the literal quote from the Microsoft Learn box, which says "early October 2026" and gives no day —the day comes from notice MC1465771, published on 1 September—; what "Set as behavior" means exactly and why the three words that matter are "or trigger incidents"; the finding that made us write this: the BehaviorInfo table reference says it is populated by Defender for Cloud Apps and UEBA and that without those services queries return nothing, and the second door, CloudAppEvents, closes with the same key; the way out that is safe and almost nobody mentions; why we are not telling you to disable the rule; the line that leaves a third route open —built-in rules do not apply to custom detections— with its full price; and four checks, two of them queries you can paste today.

Microsoft 365 Data Compliance
Read more →
Sala de reuniones vacía con dos pizarras blancas y sillas alrededor de una mesa larga
9 min read

Your patching policy has no entry for "there is no patch"

On 21 September someone broke into the Dutch Institute for Vulnerability Disclosure, the people whose job is telling everyone else to patch. Eleven days later, the second of the two chained flaws still has no published fix. Inside: the timeline the victim published under its own name; why the headline —"an AI agent did it"— is not what decides the outcome, and what the logs actually say ("loud and very messy"); the advisory field reading "Patch status: Available" two sections above the paragraph saying the vendor "are working on a fix", and why your vulnerability process reads the field and not the paragraph; the two public documents that do not agree and are both true; what is left when the patch does not exist —break the chain at the other link, remove exposure, cut the blast radius, raise detection—; and the paragraph missing from your security policy, written out in full so you can copy it, with the two clauses that make it work: it expires by itself, and it carries a name and a job title.

Patching Cybersecurity Continuity
Read more →
Pasillo de un archivo con estanterías compactas llenas de cajas de archivo numeradas
9 min read

The first AI-agent breach is on file. The hard part was being able to describe it

On 14 September the Spanish data protection authority published that it had received the first notification of a personal data breach that "would have been executed by means of an artificial intelligence agent" — its own conditional. The whole attack fits in one sentence, and the authority warns the information comes from the affected organisation and is still pending analysis. We read those four phases as what they will eventually be for somebody else: a regulator's form with a 72-hour clock on it. Which record you need to write each sentence, why "autonomously" is inferred rather than logged, what the authority now expects in writing in your risk assessment, and why three of the four phases are stopped by boring things that involve no AI at all.

AI Compliance Cybersecurity
Read more →
Sala de reuniones vacía con mesa larga, sillas y una pizarra de cristal borrada al fondo
5 min read

Your Teams chats are not in your backup

Microsoft 365 Backup protects three workloads: OneDrive, SharePoint and Exchange Online. Teams chat is none of them. And on the limitations page of one of the most widely deployed third-party tools, individual and group chats appear in the list of what is not backed up. Where a Teams message actually lives according to Microsoft's own documentation, why a retention policy preserves but does not restore, the 21 days it takes a deleted message to reach the SubstrateHolds folder, and the six questions we ask of a company's Microsoft 365 backup before touching anything.

Backup Microsoft 365 Continuity
Read more →
Nave de un centro de distribución: estanterías metálicas con palés embalados y pasillo de preparación de pedidos
8 min read

Cutting you off takes 101 minutes; reconnecting you, nine days

Boston Scientific disclosed its incident on a Wednesday. That same day, 101 minutes after the first notice, the platform its customers use to send it orders cut every one of its global connections. It took nine days to give them back. The full timeline sits on a public status page and teaches three things that are in almost no continuity plan: who decides to disconnect you, which degraded channel keeps you alive meanwhile, and why your status system stops telling the truth.

Continuity Disaster recovery Compliance
Read more →
Reloj de pared de esfera oscura en una pared gris de oficina
8 min read

Cyber Resilience Act: 24 hours to report, and the clock does not start with the CVE

Article 14 of the Cyber Resilience Act starts to apply today: 24 hours for the first warning about an actively exploited vulnerability. Two details almost nobody is covering: it is the only article the regulation stretches backwards, reaching what you have already sold, and the deadline runs not from the CVE being published but from the moment you "become aware". That turns a legal obligation into an instrumentation problem: telemetry, a watched mailbox and who declares the time.

Regulation Compliance Cybersecurity
Read more →
Fila de puestos de trabajo vacíos en una oficina
10 min read

Entra ID retires memberOf on 3 November: after that date, membership stops being recalculated

Message centre post MC1448379, published on 5 August, has been read as a deadline. Read it the other way round: if you run a memberOf rule in production, you already have the problem it describes, and the preview documentation says so in a paragraph almost nobody reads. What happens on 3 November is not an outage or an error: memberships stay "in their last known state". That is where licences, Conditional Access and Teams membership hang from.

Identity Microsoft 365 Licensing
Read more →
Sala de celdas de media tensión de una subestación eléctrica
12 min read

"Resilience" is in the title of Spain's data centre decree. It is not in the articles

The consultation window closed today at 17:00. The draft is called "energy and environmental sustainability, resilience and digital sovereignty requirements applicable to data centres", and its article 5 carries "resilience" in the heading. Read in full, it creates not a single resilience requirement: it defers them to whatever regulation already applies to you. We think that is sound legislative technique and bad news for anyone hoping somebody would hand them availability. It does not bind you — the threshold is 1 MW of grid access capacity — but it will reach you anyway, through the contract of whoever hosts you.

Regulation Datacenter Colocation
Read more →
Cajas de archivo numeradas en estanterías de un depósito documental
9 min read

One checkbox will protect a whole workload in Microsoft 365 Backup. What it bills is not what you see in the usage report

Full Workload Backup reaches general availability from mid-September: one policy per workload protecting every SharePoint site, or every OneDrive account, or every mailbox, including the ones created later. List price is $0.15 per GB per month, applied to a base that adds in the second-stage recycle bin and online archives. Microsoft warns that its own usage report includes neither, "and is thus incomplete", and offers a calculator that does ask for them. The problem is that the report is what everybody looks at.

Backup Microsoft 365 Costs
Read more →
Priority Cleanup de Microsoft Purview: borrar por encima de la retención en Microsoft 365
9 min read

Deleting above retention: three approvals in Exchange, one in SharePoint

Microsoft Purview Priority Cleanup deletes Microsoft 365 content by overriding retention policies, labels and eDiscovery holds, and the documentation says what it deletes cannot be restored by users, by admins, or by Microsoft. Mailboxes always demand three approvals; SharePoint and OneDrive, one — and none from the retention owner. What stops it, what to switch off beforehand, and what it asks of your backup.

Microsoft 365 Backup Compliance
Read more →
Sala de espera de oficina en penumbra con tres sillas grises alineadas contra la pared
5 min read

Guest Wi-Fi is a database of people (and it is not in your inventory)

Manchester Airports Group confirmed on 27 August that an unauthorised third party took customer data: email addresses, phone numbers, vehicle registrations and postcodes, from car park, lounge and Fast Track bookings and from in-airport Wi-Fi sign-ups. The company has not published how many people are affected; reporting puts it at around 8.7 million. Operations were unaffected, and that is precisely the problem: the system holding the most people is almost never at the top of your criticality list. Why the number plate is the field to watch, and the six questions worth one afternoon of inventory at your own front desk.

Privacy Zero Trust Networking
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN