In 2021, I gave a lunch-and-learn called Cybersecurity and Your Company. Colonial Pipeline had just been attacked. Ransomware was dominating the headlines. Remote work had exploded. I opened with a joke about hackers apparently having nothing better to do during lockdown. The presentation was built around ten practical things a small business could do to reduce its risk.

I recently pulled it back up and read through the entire thing. What surprised me was not how badly it had aged. It was how much of it still holds up.

Leadership needs to own cybersecurity. Train your employees. Use multi-factor authentication. Stop reusing passwords. Maintain good backups. Patch your systems. Know what is on your network. Encrypt sensitive information. Assess your risk. Pay attention to your vendors. I would give most of that advice today.

But cybersecurity advice does not become obsolete all at once. The principles tend to survive longer than the specific way we implement them. Attackers adapt to the defenses we put in place, technology changes, and controls that once provided reasonable protection may eventually become only one piece of a larger defense.

There were also a few things in my 2021 presentation that were simply wrong. So rather than rewrite the old talk and pretend we knew in 2021 what we know today, I thought it would be more useful to audit it. What was wrong? What still works? What needs to change? And, most importantly, what should a business be doing now?

First, a statistic I should never have used

One of my opening slides made this claim:

60% of small companies go out of business within six months of a cyber attack.

You’ve probably heard some version of that statistic. It appeared in security presentations, articles, vendor marketing, government testimony, and plenty of places that looked credible. The problem is that there is no reliable research behind it.

The National Cybersecurity Alliance, which was frequently cited as the source, eventually issued a statement saying the statistic did not come from its research, that it could not verify the original source, and that people should stop using it.

I repeated it because I found it through sources I considered credible. That is an explanation, not a justification. Cybersecurity has enough real risk that we do not need scary statistics we cannot defend.

That is still a lesson I carry into conversations with clients today. When someone tells you that “X percent of businesses” will experience some catastrophic outcome, ask where the number came from. Good security decisions should be based on risk, evidence, and business impact, not fear.

A few other things needed correcting

Reading the old presentation with five more years of experience also exposed some technical shortcuts I would not make today. I referred to application allowlisting as a “zero-trust security model.” That was too broad.

Application allowlisting is an excellent security control. Limiting software so that only approved applications can execute dramatically reduces the opportunity for malicious or unauthorized code to run. But that is not the definition of zero trust.

NIST describes zero trust much more broadly. The concept is that users, devices, and systems should not receive implicit trust simply because they are inside a network, belong to the company, or authenticated once. Access should be explicitly authenticated and authorized based on the resource being accessed and the context of the request.

The control I was recommending was good. The label I put on it was wrong.

I also referenced the large Facebook data exposure that was making news at the time and said email addresses and passwords had been stolen. Facebook stated that the exposed dataset did not contain passwords.

Again, the larger advice was sound: assume personal information and credentials will eventually be exposed somewhere, never reuse passwords, and protect important accounts with additional authentication. But facts matter, especially when you’re the person standing in front of the room teaching them.

What aged remarkably well

There is another side to rereading the presentation. A lot of the fundamental advice held up very well.

Cybersecurity is a leadership issue

My first recommendation in 2021 was that cybersecurity is a team sport. I argued that business leaders could no longer treat security as something delegated entirely to the IT department. That position has only become stronger.

When NIST released version 2.0 of its Cybersecurity Framework in 2024, it added Govern as an entire sixth function alongside Identify, Protect, Detect, Respond, and Recover. NIST specifically describes cybersecurity as enterprise risk that senior leadership should manage alongside risks such as finance and reputation.

Cybersecurity is not an IT project. It is a business-risk function that happens to involve a lot of technology. Someone still has to configure the firewall, protect the endpoints, and manage identities. But leadership determines what risks are acceptable, what information matters, how much resilience the company needs, what vendors can access the environment, and how the organization will respond when something goes wrong. That distinction matters.

Password advice actually got simpler

In 2021, I told the audience that passwords should be “like vacations: long and memorable.” I also told them to stop constantly changing passwords just because 30 or 90 days had passed. That advice has held up.

Current NIST guidance puts much more emphasis on password length and screening passwords against known compromised values. It specifically says not to impose arbitrary character-composition rules and not to require periodic password changes unless there is evidence of compromise.

For a password being used by itself, current NIST guidance requires a minimum of 15 characters. When a password is only one component of multi-factor authentication, shorter minimums are permitted. For a business, the practical advice is straightforward:

Use long, unique passwords. Use a password manager. Do not reuse credentials between systems. Block known-compromised passwords. Protect important accounts with MFA. And stop teaching employees that Summer2026! is a strong password simply because it checks the uppercase, lowercase, number, and symbol boxes.

Assessments still find the things nobody remembers

One story from the presentation still captures why I believe strongly in cybersecurity assessments. We once assessed a business and discovered thousands of Social Security numbers sitting in Excel files stored in someone’s personal Dropbox account. The information had been collected over the years for legitimate business reasons, but nobody remaining in the organization really knew the files existed or how the process had evolved.

That is what risk assessments often uncover. Not movie-plot hacking.

Old accounts. Forgotten systems. Former employees with access. Unsupported software. Sensitive information stored where nobody realized it was being stored. A firewall nobody knows how to update. A vendor with permanent administrative access. A backup nobody has actually tried to restore. You cannot protect what you do not know you have. That was true in 2021. It may be even more important today.

Where good advice needs stronger controls today

This is where the old presentation becomes more interesting. Several recommendations were right, but the threat model changed around them.

Phishing is no longer supposed to look suspicious

I spent several slides teaching people how to inspect a phishing email. The sender domain was wrong. The destination of the link was wrong. There was a typo. The language sounded awkward. Then I made a comment that I certainly would not use today:

“It’s a good thing hackers typically don’t speak English as their first language.” Beyond being an unnecessary generalization, grammar has become a much weaker security signal.

Generative AI can produce professional, natural, context-aware writing in seconds. An attacker no longer needs strong English skills to write an excellent English phishing message. They can also generate messages tailored to a company, an employee, a job function, or a recent event. And email is only one delivery mechanism.

Social engineering now happens through text messages, phone calls, Teams, social media, fake websites, search results, and other communication channels. Verizon’s 2026 research specifically points to growth in mobile-focused social engineering using text and voice.

I still want employees to notice suspicious domains, unexpected links, and unusual requests. But I put less emphasis today on teaching people to become amateur forensic analysts. For important actions, the better lesson is:

Do not just detect. Verify.

  • If an email tells you to log into Microsoft 365, open the site yourself rather than trusting the supplied link.
  • If a vendor unexpectedly changes banking information, verify the change using contact information you already have.
  • If an executive asks you to do something unusual involving money or sensitive data, validate the request independently.

The goal is no longer to make employees perfect at identifying fake communications. The goal is to build business processes that remain safe even when the fake is very good.

A voice is not proof of identity

In the original presentation, I recommended an explicit company policy around financial requests: do not execute wire transfers, account changes, gift-card purchases, or similar financial instructions from an email alone. Verify the request verbally.

That was useful advice then, and moving verification to another channel is still useful now. What has changed is what we consider adequate verification.

In 2024, engineering firm Arup confirmed that an employee in Hong Kong was deceived during a sophisticated deepfake video conference. Fraudsters digitally impersonated company personnel, and approximately $25 million was transferred as part of the scheme. That changes the rule.

“I heard his voice” is no longer enough.

Today I would tell a company to build financial controls around independent verification, not recognition. For example:

  • A payment change gets verified by calling a known number already on file, not one supplied in the request.
  • Changes to banking information receive additional scrutiny.
  • Significant transfers require approval from more than one person.
  • Urgency does not override the process.
  • Employees know they will never be punished for slowing down a financial transaction because something does not look right.

The principle from 2021 survives. Do not trust an email just because it appears to come from someone you know. The modern version goes one step further. Do not make trust dependent on recognizing someone’s face, voice, email address, or phone number. Build a process around independent verification.

MFA is still essential, but the type matters

I strongly recommended multi-factor authentication in 2021, and I would make the recommendation even more strongly today. The original demonstration showed an executive’s account being targeted by automated login attempts from around the world. MFA provided another barrier even if an attacker obtained the password. That fundamental concept remains correct.

But saying “we have MFA” tells me less today than it did five years ago. Attackers have learned how to work around weaker forms of MFA. Adversary-in-the-middle phishing can proxy a legitimate login process and steal the session created after authentication. Attackers can bombard users with push notifications hoping someone approves one. Social engineering can target the help desk and convince someone to reset an MFA method. Malware on an endpoint can steal credentials and session information without attacking the MFA system directly.

That does not mean MFA failed. It means the implementation matters.

Today, I would prioritize phishing-resistant authentication such as FIDO2 security keys and passkeys, particularly for administrators and other high-value accounts. NIST’s current authentication guidance requires AAL2-capable systems to offer a phishing-resistant option and recommends phishing-resistant authentication whenever practical. SMS-based authentication is still better than password-only authentication, but it is a restricted method under current NIST guidance, and it should not be mistaken for the strongest option available.

There is also another control that businesses often overlook: what is your process when someone calls and says they lost their phone and need MFA reset?

Your authentication system can be excellent while your account-recovery process becomes the back door. The help desk needs an identity-verification procedure just as much as users need MFA.

Backups are still critical, but ransomware is also a data-breach problem

My backup slide was simple: backup, backup, backup. I emphasized keeping backups away from the production environment and actually testing restores. I would still give that advice.

What I overstated was the idea that good backups meant companies would no longer need to consider paying a ransom. Even by 2021, ransomware had evolved beyond simply encrypting files. Attackers were stealing data before encryption and threatening to release it publicly. ENISA described double extortion as a common ransomware tactic throughout 2020.

A backup solves an availability problem. It does not undo data theft. That distinction is even more important now.

Verizon’s 2026 DBIR found ransomware involved in 48% of breaches in its dataset, while 69% of ransomware victims did not pay. The median payment also continued to decline. Better recovery capability is part of that story.

So the modern backup strategy is not “have a backup.” It is:

  • Maintain backups that attackers cannot easily alter or destroy.
  • Keep appropriate copies isolated or immutable.
  • Test actual restoration, not just whether the backup job reports success.
  • Know how long recovering critical systems will take.
  • Know what data you hold, because restoration does nothing about information that was already stolen.
  • Have an incident-response plan for both operational recovery and breach response.

The question I asked in 2021 is still one of my favorite questions to ask a business:

When did you last successfully restore something from your backup?

If nobody can name the date, you have learned something important.

Patching moved closer to the front of the line

In 2021, I called out companies still running Windows XP and Windows 7. The names have changed. Windows 10 reached end of support on October 14, 2025, and systems that remain on it now require an appropriate Extended Security Updates strategy or migration to a supported platform.

But the bigger development is where attackers are focusing. According to Verizon’s 2026 DBIR, exploitation of vulnerabilities became the leading initial-access vector in its dataset for the first time, accounting for 31% of breaches. That should change patching priorities.

Five years ago, “keep everything patched” was reasonable advice. Today I would make it more specific. Start with what the internet can reach.

Firewalls. VPN appliances. Remote-access systems. Web applications. Email infrastructure. Management portals. Anything sitting at the edge of your environment. Then use evidence of actual exploitation to prioritize remediation. CISA’s Known Exploited Vulnerabilities catalog is often a more useful priority list than simply sorting every vulnerability by its theoretical severity score.

Inventory still comes first. You cannot patch a device nobody remembers exists. But today’s lesson is that patching speed and prioritization matter just as much as having a patching process.

Three risks I would put much higher on the list today

If I gave the presentation again, there are several areas that would receive far more attention.

1. Your vendors are part of your security environment

I ended the 2021 talk by telling businesses to ask their vendors what they were doing to protect their data. That deserved much more than a closing comment. Verizon’s 2026 DBIR found third parties involved in 48% of breaches in its dataset, a 60% increase from the previous year’s data.

Your attack surface is not limited to devices sitting inside your office. Your payroll company has data. Your accounting firm has data. Your cloud applications have data. Your IT provider may have administrative access to nearly everything.

The security of the organizations you depend on has become part of your own security posture. Vendor management does not need to become a thousand-question compliance exercise for every small business. But you should at least know which vendors hold sensitive information or have privileged access, what controls they maintain, and what happens to your business if one of them is compromised.

2. Shadow AI is today’s version of shadow IT

In 2021, I worried about unauthorized Dropbox accounts and software employees installed without anyone knowing. Today, businesses have a new version of the same problem. Employees can paste a contract, financial report, customer database, medical record, source code, or confidential strategy into an AI tool in seconds.

The technology can provide enormous value. The governance often has not caught up. Verizon’s 2026 research reported a substantial increase in employees using unapproved AI tools and identified shadow AI as a growing source of non-malicious data leakage.

The answer is not to ban AI and pretend employees will stop using it. Businesses need an AI-use policy. Decide which platforms are approved, what information employees can submit, what should never leave the organization, and how AI-generated work will be reviewed.

The same governance principles apply as any other technology. Know what you are using. Know where your data is going. Decide what level of risk you are willing to accept.

3. Cyber insurance is not a substitute for security

My 2021 presentation recommended cyber liability insurance. I still do. But I would describe its role differently today.

Cyber insurance transfers part of the financial risk that remains after you implement reasonable safeguards. It does not make the underlying risk disappear. And buying the policy is only part of the work.

Insurance applications increasingly ask detailed questions about controls such as MFA, endpoint protection, backups, remote access, and incident-response capabilities. What matters is that the answers accurately describe the environment being insured. “We have MFA” is not a useful answer if nobody has asked: where? On which accounts? Using which methods? What about administrators? Remote access? Backup systems?

Security controls need to exist in reality, not just in an insurance questionnaire.

What five years actually taught me

Reading the presentation again changed my opinion of it, but not in the way I expected. The biggest lesson is not that cybersecurity advice from 2021 was bad.

It is that the principles aged better than the implementations.

Leadership still matters. MFA still matters. Backups still matter. Patching still matters. Training still matters. Encryption still matters. Risk assessments still matter. What changed is what a competent implementation of those controls looks like.

MFA evolved from “turn it on” to asking whether it is phishing-resistant and whether account recovery is protected. Phishing training evolved from spotting spelling mistakes to independently verifying unusual requests. Backup strategy evolved from recovering encrypted files to surviving both operational destruction and data extortion. Patching evolved from running Windows Update to aggressively protecting internet-facing infrastructure and prioritizing vulnerabilities attackers are actually exploiting. Vendor management moved from procurement paperwork to attack-surface management. AI created an entirely new channel through which employees can accidentally expose information. And zero trust became much more than a marketing phrase attached to a security product.

That is how cybersecurity works. Attackers adapt. Technology changes. Business processes change. Controls that were reasonable five years ago may still be useful today, but they should not be assumed to provide the same level of protection. There is no security policy you can write once and consider finished.

Put security review on the calendar

If I had to replace the entire 2021 presentation with one recommendation for a business owner today, it would be this: review your cybersecurity program at least once a year.

Do not just ask whether the controls you documented are still in place. Ask a harder question: if someone wanted to get around this control today, how would they do it?

  • If you require MFA, how would an attacker bypass or reset it?
  • If you verify payments verbally, how do you know who is really on the phone?
  • If you have backups, can an administrator account delete them?
  • If employees are trained on phishing, what happens when the message arrives through text or Teams instead?
  • If your computers are patched, what about the firewall?
  • If your employees use AI, what information are they putting into it?
  • If a trusted vendor is compromised, what can that vendor reach inside your business?

Those questions produce a much better security conversation than asking whether you bought the right products.

I gave a cybersecurity talk in 2021 with ten practical recommendations. Five years later, I found a few facts I needed to correct, several controls that need to be implemented differently, and some risks that deserve far more attention than I gave them then. I also found that most of the fundamentals still work. That may be the most useful lesson of all.

Good cybersecurity is not about predicting the next attack.

It is about building an organization that continually understands its risk, adapts its defenses, and can keep operating when something eventually gets through.