TechTidBit - Tips and advice for small business computing - Tech Experts™ - Monroe Michigan

Brought to you by Tech Experts™

Why AI Training Is A Business Essential

Thomas Fox is president of Tech Experts, southeast Michigan’s leading small business computer support company.

There is a good chance someone in your business is already using AI.

They might be using it to draft emails, summarize notes, organize information, research ideas, or even to help with presentations and reports.

AI has arrived long before any formal plan for using it.

The conversation around workplace AI usually focuses on the technology. Which tools should we use? Which platform is best? How quickly should we adopt it?

But the more important question is simpler: Do people know how to use it properly?

Like any workplace tool, AI delivers the best results when people understand both its strengths and its limitations.

Used well, it can save time, remove repetitive admin, and help people focus on higher-value work.

Used poorly, it can create confusion, introduce errors, and increase the chances of sensitive information ending up in places it should not.

The challenge for businesses is that employees are often learning about AI from social media, online videos, articles, and conversations with colleagues rather than from their employer.

That means people inside the same business can develop different habits and expectations around the technology.

Some become confident users very quickly.

Others avoid it altogether because they worry about getting something wrong.

Good AI training helps employees understand where AI adds value, where human judgment is vital, what information should never be shared, and how to spot when an answer needs checking rather than trusting automatically.

Importantly, that training should reflect the work people do.

The way a finance team uses AI will look different from marketing, operations, customer service, or leadership teams.

A one-size-fits-all approach probably won’t cut it.

Invest in practical guidance now and you’re likely to find adoption becomes more consistent, confidence grows more quickly, and security concerns become easier to manage.

Because whether you actively encourage AI use or not, the technology is already finding its way into the workplace.

Training helps make sure it arrives in a way that benefits the business as much as the people using it.

If you need help with training your team, get in touch. Give us a call at (734) 457-5000, or email us at info@mytechexperts.com.

Why Employees Shouldn’t Have Administrator Access To Their PCs

Administrator access often starts with a reasonable request.

Someone needs to install a printer, update a program, or change a setting, so they’re made an administrator on their computer. The task gets done, but the access stays.

From then on, that employee can approve software installations and make changes that normally require help from IT.

If they download a fake installer or approve a harmful program, it may be able to install system components, change security settings, or affect other information on the computer.

For email, web browsing, documents, meetings, and most business applications, employees should use standard accounts. Administrator access should be reserved for approved IT work.

What administrator access allows

On Windows, members of the local Administrators group have broad control over that computer.

They may be able to install software, add drivers, manage other local users, and change system settings or file permissions.

Why standard accounts are safer

Programs normally start with the permissions available to the person who launches them. If an employee can approve an administrator request on their own, harmful software may receive the same level of access.

Windows uses User Account Control to ask before many important changes. An employee using an administrator account can approve that request.

A standard user is normally asked for administrator credentials, which gives IT an opportunity to check the program and where it came from.

Standard accounts still support normal work. Employees can use email, browsers, Microsoft 365 or Google Workspace, meetings, approved software, printers, and shared files.

How to handle software installations

Employees can still get software installed without keeping administrator access. Your IT team can install it remotely, approve a request when it is needed, or deploy updates to several computers at once.

Test specialist or older software before changing permissions across the business.

If a program expects the user to be an administrator, your IT provider may be able to change its setup or find a supported alternative.

Keep a separate administrator account for approved technical work. Do not use it for email, web browsing, or everyday tasks. Protect it with multifactor authentication where the system supports it.

Check who has access now

Ask your IT provider to review the administrator accounts on every company computer, including former employees, shared logins, vendor accounts, and accounts created during the original setup.

Before removing access, confirm that IT still has a tested way to perform administrator tasks on every device.

Standard accounts let employees do their jobs without giving them or the software they run more control than normal work requires.

Should Your Team Use Personal Devices For Work?

Allowing employees to use personal phones or computers can be convenient. They already know the device, and they can check email or join a meeting without carrying another piece of equipment.

But the business still needs to decide what work is allowed, which applications employees may use, and what happens to company information if a device is lost or an employee leaves.

Personal devices can be suitable for limited work when they meet your security requirements. Company-owned devices are a better choice for sensitive work, administration, or jobs that require large amounts of business data to be stored on the device.

What counts as a personal device used for work?

Bring your own device, often shortened to BYOD, includes reading company email on a personal phone, opening documents in mobile apps, or using a home computer to connect to a business system. Files may remain in the Downloads folder, and accounts can stay signed in after the work is finished.

Decide what employees may do

Set the rules according to the work and the information involved. You might allow employees to read email through an approved mobile app but require a company computer for customer database exports, payroll, system administration, or access to sensitive client records.

Staff should know which devices and applications are permitted, whether they may download files, and what they must do before selling or replacing the device.

Set minimum security requirements

A personal device should run an operating system that still receives security updates. It should have a screen lock, device encryption where available, current updates, and multifactor authentication on company accounts. A lost or stolen device must be reported quickly.

Keep business information inside approved applications or a managed work profile where possible. Device and app management tools can apply security settings and, on supported platforms, remove company data from managed apps. Tell employees what the business can see or remove before they enroll their device.

Plan for a lost device or departing employee

If a personal device is lost, IT may need to revoke active sessions, reset affected passwords, and remove company information from managed apps.

When an employee leaves, disable their account and active sessions at the agreed time. Remove company data from managed apps, check for downloaded files, and confirm that business information has been returned or deleted.

When to provide a company device

Use a company-owned device when an employee handles sensitive information, needs administrator access, stores a large amount of data locally, or requires specialist software. It is also the better choice when IT needs full control over updates, backups, applications, and security monitoring.

BYOD can work, but only when the rules are clear and the device can meet them. If your business allows personal devices, ask your IT provider to review the policy, access settings, and offboarding process before a lost phone or employee departure puts company data at risk.

Do You Know What Software Is Installed On Your Computers?

Most businesses have a pretty good idea how many computers they own. They may even know who uses each one.

But ask what software is installed on those computers and the answer can be much less certain.

Over time, employees install PDF tools, browser extensions, meeting applications, printer utilities, and other software they need to get something done.

Some of it is useful. Some was installed for a project three years ago and hasn’t been opened since. And some probably should never have been installed in the first place.

The problem isn’t necessarily that employees are doing anything wrong. Most are simply trying to get their work done. But every piece of software installed on a business PC becomes something that needs to be managed.

Software adds up quickly

Think about a computer that’s been in service for several years. Employees may have installed utilities. Before long, that computer can have dozens of programs beyond the applications the business actually uses.

Each one represents another potential maintenance or security issue.

Software needs updates. Older applications may stop receiving them altogether. Some programs install background services that continue running even when nobody uses the application.

A program doesn’t have to be malicious to become a problem. It may simply be old, forgotten, and vulnerable.

Free software isn’t always free

Employees often search online when they need to perform a task their existing software can’t handle.

Need to edit a PDF? Search for a free PDF editor. Need to convert a file? Download a converter.

The employee may solve the immediate problem, but nobody has reviewed the software, its publisher, or what else was included with the installation.

This is one reason administrator access should be limited on company computers. Requiring IT approval before software is installed creates an opportunity to make sure the program is legitimate, supported, and appropriate for business use.

Don’t forget the web browser

Not everything employees use appears in the Windows list of installed programs. Browser extensions have become applications of their own. Employees may add extensions for screenshots, grammar checking, productivity, document handling, or dozens of other purposes.

Depending on the permissions granted, an extension may be able to read information displayed in the browser or access information employees enter online.

Many extensions are legitimate and useful. Businesses should still know which ones are being used and remove those that aren’t necessary or approved.

Remote access deserves special attention

IT providers and software vendors frequently use remote access tools for legitimate support. Employees may also install their own remote access application so they can reach a work computer from home.

The problem comes when nobody knows those programs are there.

Old remote support applications can remain installed long after a vendor relationship has ended. Your IT provider should know which remote access tools are installed, who uses them, and why they are needed.

Start with an inventory

Modern IT management tools can collect an inventory of installed applications across company computers. That information can then be reviewed for software that is outdated, unnecessary, unauthorized, or no longer supported.

Pay particular attention to remote access programs, old versions of common applications, software from unknown publishers, and applications installed by former employees.

The goal isn’t to strip every computer down to the bare essentials. Employees need tools to do their jobs.

The goal is to know what’s there.

Once you have an inventory, establish a simple process for approving new software and periodically reviewing what’s installed.

Your computers shouldn’t accumulate software forever. If nobody knows what a program does, who installed it, or whether it’s still needed, that’s a good reason to take a closer look.

Ask your IT provider to review the software installed across your company computers. You may be surprised by what’s been quietly collecting there.

The First Question I Ask Every New Client

Thomas Fox is president of Tech Experts, southeast Michigan’s leading small business computer support company.

When I sit down with a new client for the first time, I don’t start by asking what software they use or what their network looks like.

I ask one simple question: When was the last time you actually tested your backup?

Not “do you have a backup.” Almost everyone says yes to that. I mean REALLY tested, like we do at Tech Experts. Restore a file, open it, and make sure the contents are really there.

The answer tells me more about a business’s real risk than almost anything else I could ask. Most of the time, people pause.

They know backups are running and they’ve seen the “green checkmark” or the automated email confirming success. What they haven’t done is actually try to get their data back.

The action of making sure the backups are restorable matters more than people realize. A backup that runs every night but has never been tested is really just a hope, not a plan.

I’ve seen businesses discover their backups were incomplete, corrupted, or hadn’t run properly in months, and they only found out when they needed the files most, or when disaster struck.

By then, it’s too late to fix quietly. It becomes a crisis instead of a non-event.

The second question I ask

Once we’ve talked about backups, I ask something else: who can see what on your network?

This one usually gets a longer pause. Most business owners can tell me who has a login. Most can’t tell me what each of those logins can actually access. In a busy office, permissions pile up over time. That employee who got access to the accounting share for a one-time project keeps it long after the project ends. Even worse (and we see this all the time) is when a former employee’s account gets disabled but never fully removed.

By themselves, none of these seem like an urgent problem. Together, they add up to a business that doesn’t really know who can touch its data. That’s a hard position to defend from, whether the threat is a hacker or just an honest mistake.

Why I ask these two first

Neither question is technical. I’m not asking about firewalls or encryption or anything like that. I’m asking whether you actually know what would happen if something went wrong today. This helps me understand a client’s risk tolerance, and how much importance they place on their IT systems.

Most businesses I meet have invested in tools. They have antivirus and a firewall, and some kind of backup system. What they often haven’t done is confirm that any of it actually works the way they think it does.

Untested backups and unmanaged access are two of the most common ways I’ve seen businesses get hurt. These companies aren’t careless, they just didn’t know they should be checking these things.

That’s really what these two questions are getting at. It’s not about whether you have the right tools. It’s about whether you actually know your own risk. Most business owners are surprised by how much clarity comes from just asking.

Are Your AI Problems Business Problems In Disguise?

By now, you’ve probably experimented with AI in some form.

Maybe it’s helping write documents, summarize meetings, analyze spreadsheets, or speed up customer service.

You see the potential very quickly…

But then the excitement fades.

A handful of people keep using it every day, a few others stop using it altogether, and before long, you’re left wondering why the big AI transformation never fully arrived.

It’s tempting to blame the technology, but the problem is often much more human.

Businesses struggle because they haven’t changed the way work happens around AI tools.

Imagine introducing a new piece of machinery into a factory but keeping the same production process around it. You’d never see the full benefit.

AI works in the same way.

If employees are expected to experiment but still judged entirely on speed, consistency, and avoiding mistakes, most will stick with the methods they already know.

If nobody takes ownership of how AI fits into the business, good ideas can stay trapped inside individual departments instead of becoming part of everyday work.

The same challenge appears when there isn’t a clear approach to how AI should be used across the business.

Employees want to know what they’re allowed to use, what information can be shared, and where the boundaries are.

Without clear guidance, many people become cautious. Others simply make up their own rules.

Getting the best results from AI usually means changing the way work gets done, not only adding new software.

Give people permission to experiment, create clear ownership, and build AI into existing processes rather than leaving it as an optional extra.

AI is moving into workplaces quickly.

Giving people the skills, confidence, and guidance to use it well may turn out to be as important as the technology itself.

If you’d like help putting the right foundations in place, give us a call at (734) 457-5000, or email us at info@mytechexperts.com.

Why Hackers Don’t Need Ransomware Anymore

Is your business ready for an attack that doesn’t lock your files but steals them instead?

Cybercriminals are changing their approach, and it’s worth understanding what that shift means for you.

For years, ransomware was the story. Hackers broke in, encrypted your files, and demanded payment to get them back.

That threat hasn’t gone away, but a quieter and in some ways more dangerous tactic is catching on: stealing your data first and threatening to publish it if you don’t pay.

That data might be financial records, customer information, contracts, intellectual property, or internal documents you’d never want made public.

Between privacy regulations and the damage to your reputation, having sensitive information exposed can hurt just as much as losing access to your systems, sometimes more.

This shift matters because it changes the calculation for business owners. With traditional ransomware, restoring from a good backup often took the leverage away from the attacker. Data theft works differently.

Once your information is copied, having a backup doesn’t undo the exposure. The only real protection is keeping attackers from getting their hands on the data in the first place.

Attackers are looking for the easiest way in

One of the biggest openings hackers exploit is outdated software.

Any device or application that hasn’t been updated is a potential doorway, and that includes file sharing platforms, remote access tools, internet-facing devices, and other systems your business depends on every day.

A single unpatched vulnerability has been enough, in some cases, for attackers to compromise dozens of organizations before anyone noticed something was wrong.

Hackers actively scan the internet for these gaps, so a system that’s been overlooked for even a few weeks can become an easy target.

That’s why keeping your systems patched and current remains one of the most effective things a business can do to protect itself.

It’s not flashy, and it doesn’t make headlines, but it closes off the doors attackers rely on most.

Modern attacks are harder to catch

Hackers are also getting better at hiding in plain sight. Rather than using obviously malicious software that antivirus tools are built to catch, many now rely on legitimate tools already built into Windows and other operating systems.

Because these tools are normally used for everyday administration, it becomes much harder for security software to tell the difference between an IT technician doing routine work and an attacker moving through your network.

Virtual servers have become a favorite target for this reason. These are the systems that host multiple applications and services at once, which means a single compromised server can give an attacker access to far more than they’d get from a single computer.

Once an attacker gets into one, they can move through your systems quickly and cause widespread damage before anyone realizes there’s a problem.

The best defense is still the basics

Attacks keep evolving, but the fundamentals of good cybersecurity haven’t changed much at all. The businesses that hold up best under these newer, sneakier attacks tend to do a few things consistently well:

  • Keep operating systems and applications fully patched
  • Monitor for unusual activity across every device on the network
  • Maintain visibility into who is accessing systems and what they’re doing

Have a tested incident response plan in place before trouble hits

None of this is new advice. But businesses that stick to these basics put themselves in a much stronger position, both to avoid an attack and to recover quickly if one happens anyway.

Cyber threats aren’t going to stop getting more sophisticated. The encouraging part is that your defenses don’t have to fall behind. A little consistency with the fundamentals goes a long way.

If you’d like help understanding where your business stands or strengthening your defenses, give us a call at (734) 457-5000.

Could This Be The Future Of Cybersecurity?

Most cybersecurity tools work reactively.

Something suspicious happens, the system spots it, and then tries to stop the damage before it spreads.

That’s incredibly important.

But Microsoft is working on something that pushes much further: using AI to find weaknesses before attackers discover them.

The new system is called MDASH, and the idea behind it is genuinely interesting.

Microsoft has built a platform that uses more than 100 specialized AI agents working together to search for hidden security flaws inside Windows.

These agents are designed to inspect different parts of the system, test for weaknesses, and flag potential vulnerabilities automatically.

Simply put, Microsoft is using AI to hunt for security holes at a scale humans simply couldn’t manage alone.

And it appears to be working.

During testing, the system reportedly uncovered multiple previously unknown vulnerabilities inside important parts of Microsoft Windows.

This included flaws that attackers could potentially have exploited remotely over the internet.

Some of those vulnerabilities were considered critical.

These are the kinds of weaknesses that, in the wrong hands, could allow attackers to take control of systems or run malicious code.

What makes this more impressive is the accuracy.

One of the biggest problems with AI-driven security tools has always been false alarms.

Systems that flag hundreds of “possible issues” which turn out to be nothing. That creates noise, wastes time, and makes security teams less effective.

Microsoft claims MDASH has been unusually good at avoiding that problem while still finding genuine risks.

Now, before anyone assumes AI is about to solve cybersecurity completely, it’s important to keep this in perspective.

This technology is mainly being used internally by Microsoft engineers now.

It’s still early days, and even if these systems become more widely available, they won’t suddenly replace the fundamentals that keep businesses safe.

Because most cyberattacks still succeed through ordinary gaps:

  • Weak passwords
  • Unpatched systems
  • People clicking the wrong link
  • Poor access controls
  • Missing backups

Those remain the biggest risks for most businesses today.

AI-driven security tools may eventually become a powerful extra layer of protection, especially for large organizations managing huge and complex systems.

The idea of intelligent agents constantly scanning for hidden weaknesses before criminals find them is a very promising direction for the future.

But the basics are more important right now.

A fully patched system with strong passwords, multi-factor authentication, good backups, and sensible user awareness training will protect most businesses far better than chasing the latest AI security trend without solid foundations underneath it.

The future of cybersecurity probably will involve more AI working behind the scenes, both defending systems and, unfortunately, helping attackers too.

But while the technology evolves, the core principles of staying safe haven’t changed.

Good security still comes down to reducing risk, limiting opportunities for attackers, and making sure the simple things are consistently done well.

If you want to make sure your business security is up to scratch, we’d be happy to help. Get in touch. You can call (734) 457-5000 or email info@mytechexperts.com.

The Threats Hiding In The Tools You Use Every Day

Thomas Fox is president of Tech Experts, southeast Michigan’s leading small business computer support company.

How do you imagine a cyberattack? A sophisticated hacker breaking through layers of security? Using advanced tools that no regular business could possibly defend against?

The reality is usually way less glamorous.

Many breaches start with something small. A forgotten account that was never removed. A laptop that missed an update. A security setting that was switched off and never switched back on.

These are the kinds of gaps attackers actively search for because they’re far easier to exploit than forcing their way through a heavily protected system.

In other words, the danger often comes from the things nobody realized were a problem.
One of the biggest changes in cybersecurity right now is the growing focus on identities.

Instead of attacking systems directly, criminals increasingly target usernames and passwords.

Once they gain access to a legitimate account, they can move through a business much more easily because, from the outside, it looks like a normal user logging in.

That can happen surprisingly quickly. In some cases, ransomware attacks have escalated within hours of the initial breach.

The challenge is that modern businesses are complicated. Staff work remotely. Devices move between home and office.

New software gets introduced. Small gaps appear naturally, unless someone is constantly monitoring them.

Even security tools themselves can become blind spots.

You may have protection installed, but if it is misconfigured, outdated, or partially disabled, it creates a false sense of security. Attackers also rely heavily on something known as “living off the land” techniques.

This means using legitimate tools already built into Windows and Microsoft 365 to carry out malicious activity.

Because those tools are commonly used by IT teams every day, suspicious behavior can blend into normal activity more easily.

Artificial intelligence is likely to accelerate this problem.

AI tools can help criminals identify weaknesses faster, automate attacks, and adapt techniques more quickly than before.

But many of the most effective protections are the basics done well.

Strong passwords, multi-factor authentication, regular updates, controlled access permissions, and ongoing staff awareness training remain some of the strongest defenses available.

If you’d like help spotting and closing small security gaps before somebody else finds them, get in touch.

It’s Happening, Whether You Like It Or Not

AI tools are becoming a normal part of the working day.

Someone uses one to tidy up a report. Someone else asks a chatbot to summarize meeting notes. A team member installs an AI browser extension because it helps them work faster.

Most of this happens with good intentions.

But some businesses have no visibility of it at all.

This is known as “shadow AI”.

It describes employees using AI tools that haven’t been approved, reviewed, or properly managed by the business.

In many ways, it’s like shadow IT, where staff adopt their own software without involving the IT team.

The difference is that AI tools can interact with company information in deeper ways.

Employees may paste confidential documents into public chatbots, connect AI assistants to email accounts, or allow AI tools to access files and calendars without fully understanding what happens to that data afterwards.

The motivation is easy to understand. These tools save time, reduce admin, help people get through work more efficiently.

So, banning AI outright rarely works.

If employees feel the tools genuinely help them, they often continue using them secretly. At that point, the business loses even more visibility and control.

The better approach is usually to accept that AI is now part of modern work, then guide people towards safer, approved options.

Newer AI systems are becoming more capable very quickly. Tools are no longer limited to generating text or summaries.

They can search files, access systems, organize information, trigger workflows… and even carry out actions automatically.

Without proper oversight, that creates obvious security and compliance concerns.

For businesses using Microsoft 365, approved tools like Copilot offer a safer route because they sit inside existing permissions and security controls.

That doesn’t remove risk completely, but it does give businesses much better visibility over how AI is being used.

Whatever tools you’re using, the important thing is not to ignore the issue.

If you need better oversight on how your team is using AI tools, we can help. Get in touch.