Cybersecurity Office Hours: Who Holds Your Keys? Vendors, AI, and the Flaws You Didn’t Pick
Optimize your Company's Security
Secure your organization with confidence, no matter your budget, we’re here to help you optimize your cybersecurity. Fill out the form to take the first step toward stronger protection and peace of mind. Let’s work together to stay ahead of threats!
Resources Mentioned
Have I been Pwned: https://haveibeenpwned.com/
Fundamentals Training: https://get.endsight.net/monthly-cybersecurity-fundamentals-training
AI Office Hours: https://www.endsight.net/development/webinar
Last Security Office Hours: https://www.endsight.net/breaches-and-bans-q3-security-office-hours
Security Video Library: https://www.endsight.net/security-shorts
Endsight YouTube Channel: https://www.youtube.com/@EndsightIT
Risk Assessment Cybersecurity Short: https://www.endsight.net/security-shorts/risk-assessment
Credit Bureau Freeze Tip: https://www.reddit.com/r/YouShouldKnow/comments/1qfiyrd/ysk_freezing_just_the_big_3_credit_bureaus_isnt
AI-driven Cyber Attacks Blog (Microsoft): https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
Detecting AI Misuse Blog (Anthropic): https://www.anthropic.com/news/detecting-countering-misuse-aug-2025
AI Cyber Espionage Blog (Anthropic): https://www.anthropic.com/news/disrupting-AI-espionage
Internet Crime Report (FBI): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
AI Threat Tracker (Google): https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use
PHP Critical Vulnerabilities Alert (CISA): https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
Critical PHP Security Issue Article (UK NCSC): https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
ConnectWise Breach (Bleeping Computer): https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/
ConnectWise Cloud Suspension (Help Net Security): https://www.helpnetsecurity.com/2026/10/19/connectwise-cloud-backup-suspended-security-incident/
Overview
Quarterly Office Hours + Q&A
On-Demand Recording | October 22nd, 2026
No Hacker. No Breach. The Money Was Still Gone.
October was a busy month in security, and most of the biggest stories had one thing in common. The breach didn’t start with the company that got hurt. It started with a vendor they trusted, sometimes one they never chose. In this session, Stephen Hicks, Endsight’s Security Practice Manager, walks through what happened, what it means for small and midsize businesses, and what to do about it this week.
This is a high-level, strategic conversation built for business owners and leadership teams, not a technical deep dive. Stephen also shares what Endsight did for its own clients as each story broke, and he answers questions submitted by attendees.
Agenda
- The padlock problem: A certificate company issued keys anyone could guess, which meant attackers could fake trusted sites like your bank or Microsoft 365. What happened, and what to update.
- AI and the bad guys: What AI actually changes for small and midsize businesses, like better phishing, faster attacks, and easier recon. Plus what it doesn’t change.
- The flaw under most websites: The critical PHP vulnerabilities, why your website may be exposed, and the questions to ask your web developer or host.
- Your backup, someone else’s keys: The ConnectWise Cloud Backup (formerly SkyKick) compromise, why third-party apps are a growing risk, and how to review what’s connected to your Microsoft 365.
- Live Q&A: Stephen answers attendee questions, including how to tell if you’ve been compromised and how to think about data privacy with AI tools.
Speaker
Stephen Hicks
Security Practice Manager @ Endsight
Stephen has spent his entire professional career in the technology industry. He holds an MBA from Saint Mary's College and just over a dozen technical certifications including advanced cybersecurity certifications CISSP and CISM. He has a second-degree black belt in Shito Ryu Karate and loves to scuba and ski.