Latest Insights & Advisories

Cyber One Intelligence Desk

Decisions Get Easier When the Signal Is Clear.

Timely operational advisories, original security and compliance analysis, and practical technology guidance written for business leaders, not technical audiences.

A neatly managed network patch panel in a business communications room, representing an on-premises phone system connected to the internal network.

Security & Compliance BriefHIPAA Security Rule

A Critical Business Phone System Flaw Is Under Active Attack, and It Tests Your HIPAA Network Segmentation

CISA added CVE-2026-9586, an unauthenticated SQL injection flaw in the Sangoma Switchvox business phone system, to its Known Exploited Vulnerabilities catalog on September 2, 2026, after honeypots caught attackers deploying reverse shells. Roughly 4,000 Switchvox systems are reachable from the open internet, according to Shodan.

Sep 3, 2026 7 min read

Read the Article

A grid of software patches with several still flagged as unresolved, representing a delayed remote-access appliance update.

Security & Compliance BriefFTC Safeguards Rule / GLBA

A Citrix NetScaler Flaw Citrix Called "Denial of Service" Is Now Confirmed Root RCE Under Active Attack

CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog on August 26, 2026, confirming active exploitation of a Citrix NetScaler root RCE flaw.

Sep 2, 2026 7 min read

Read the Article

A hardware security key beside a phone prompting for number-matched approval.

Business Technology BlogCybersecurity

What Is a Passkey? A Safer, Faster Way to Log In Without Passwords

A passkey lets you sign in using the same fingerprint, face, or PIN you already use to unlock your phone, with no password to type or steal. Built on the FIDO standard, passkeys can't be phished because they only work on the real site they were created for, and most major platforms already support them, including Microsoft 365 at no extra cost. This guide explains how passkeys work, why they're safer than passwords, and how to start rolling them out.

September 1, 2026 6 min read

Read the Article

An analyst workstation displaying security monitoring telemetry.

Business Technology BlogCybersecurity

CISA's Two-SOC Red Team Report Shows What Actually Stops a Breach

CISA ran the same red-team tools and techniques against two critical infrastructure organizations: one detected nothing, the other stopped it in minutes. This article breaks down CISA Advisory AA26-237A, the Active Directory and cloud identity gaps behind the failure, and the alert-triage and hygiene fixes commercial IT teams should check now.

August 31, 2026 7 min read

Read the Article

A three-photo memorial montage from downtown Sevierville showing the Dolly Parton statue surrounded by flowers, an Ole Smoky storefront tribute, and the Sevier County Courthouse.

News & AdvisoriesCommunity

Remembering Dolly Parton: A Sevier County Legacy of Kindness, Imagination, and Hope

Cyber One Solutions joins our Sevier County neighbors and the East Tennessee community in mourning Dolly Parton, who died August 25, 2026, at the age of 80. From our office in Sevierville, we remember her Smoky Mountain roots, her kindness, her music, and the literacy legacy she leaves to children around the world.

Aug 29, 2026 3 min read

Read the Article

Colleagues reviewing technology work together at a shared screen.

Business Technology BlogCloud

Microsoft Teams' New Communicator App Lets You Track Who Acknowledged Your Announcement

Microsoft is rolling out Communicator, a Teams app that sends targeted announcements with built-in acknowledgment tracking and delivery reporting. Here is what changed, why it matters for commercial organizations juggling policy, safety, and IT notices, and the governance review IT teams should run before turning it on.

August 28, 2026 6 min read

Read the Article

A worker reviewing a suspicious message flagged in an email queue.

Business Technology BlogCybersecurity

QR Code Scams: How Quishing Slips Past Your Security

A QR code scam, or quishing, hides a malicious link inside an image, so it slips past the email filters that catch bad links and lands you on a personal phone outside your company's security. Microsoft reported a 146% rise in QR code phishing in the first quarter of 2026. This guide explains what quishing is, why it gets past your security, the scams that show up most, and the habits that protect your business.

August 24, 2026 6 min read

Read the Article

Business leaders reviewing cybersecurity readiness documentation.

Security & Compliance BriefCMMC

CMMC Phase 2 Is Suspended, Not Gone: What Defense Contractors Still Owe Under Phase 1

The Pentagon paused CMMC Phase 2 certification on July 13, 2026, and comment on its reform review closed August 14. Phase 1 and DFARS duties never stopped.

Aug 23, 2026 7 min read

Read the Article

A long cyber insurance application form laid out across a desk.

Business Technology BlogCompliance

Why Your Cyber Insurance Renewal Application Got Longer

Cyber insurance renewal applications got longer because carriers rewrote them around the losses they paid in 2023 and 2024. This guide explains what the new backup, MFA, wire verification, EDR, and vendor risk sections are asking, how to answer honestly, and why overstating a control can void your policy.

August 18, 2026 12 min read

Read the Article

Business team reviewing artificial intelligence governance and automation workflows.

Security & Compliance BriefTexas Data Privacy and Security Act

TRAIGA Is Now in Effect: What Texas's New AI Law Means for Your TDPSA Compliance Obligations

The Texas Responsible AI Governance Act took effect January 1, 2026, giving the Attorney General a second privacy statute to enforce against Texas businesses that develop or deploy AI systems.

Aug 16, 2026 6 min read

Read the Article

Abstract cybersecurity shield with network status and security monitoring indicators.

Security & Compliance BriefSOC 2

A Critical N-able N-central Bypass Is Exactly What SOC 2 Vendor Oversight Is Supposed to Catch

Attackers exploited an authentication bypass in the N-able N-central remote monitoring platform to seize admin control of MSP servers and reach client networks. For SOC 2-scoped service organizations, and the businesses that rely on them, it is a live test of vendor and subservice oversight.

Aug 10, 2026 7 min read

Read the Article

An incident response sequence mapped out on a whiteboard.

Business Technology BlogCybersecurity

What to Do in the First Hour of a Cyberattack

The first hour of a cyberattack is when most costly mistakes happen. This guide gives the steps in order: isolate the affected devices rather than powering them down, call your IT provider by phone, preserve the evidence, contact your bank if money moved, and where to report an attack in the US, UK, and Australia.

August 10, 2026 6 min read

Read the Article

Escalating stages of a ransomware attack unfolding over several days.

Business Technology BlogCybersecurity

How Ransomware Attackers Target Small Businesses

This composite walkthrough follows a week-long ransomware attack from public-records research to session-token theft, then shows where layered identity, email, and monitoring controls could interrupt or limit the attack.

August 4, 2026 12 min read

Read the Article

A time-locked vault door representing a fixed backup retention window.

Business Technology BlogCybersecurity

Immutable Backups: What Your Cyber Insurance Application Is Really Asking

Cyber-insurance applications increasingly ask whether critical data is protected by immutable, offline, or air-gapped backups. This plain-English guide explains what qualifies, which common setups fall short, and what proof to request before signing the application.

July 21, 2026 8 min read

Read the Article

Security analyst monitoring an active network security incident.

Security & Compliance BriefCyber Insurance Readiness

A Critical SonicWall VPN Zero-Day Is Exactly What Your Cyber Insurance Application Already Asks About

Two actively exploited SonicWall SMA 1000 flaws can expose credentials and MFA secrets. Businesses using the appliance should confirm exposure, patch quickly, review logs, and keep proof for cyber-insurance reviews.

Jul 20, 2026 6 min read

Read the Article

Network engineer maintaining secure business routing infrastructure.

Security & Compliance BriefFTC Safeguards Rule / GLBA

A Federal Router-Hygiene Advisory Is a Test of Your FTC Safeguards and HIPAA Network Controls

CISA, the NSA, and the FBI urged businesses to harden their routers against Russian state actors. The fixes they name are controls that FTC Safeguards and HIPAA already require you to have and document.

Jul 16, 2026 6 min read

Read the Article

A written information security program binder secured with a padlock.

Business Technology BlogCompliance

Understanding the FTC Safeguards Rule

The FTC Safeguards Rule (16 CFR Part 314) requires non-bank financial institutions such as auto dealers, mortgage brokers, tax preparers, and title companies to build a written information security program. This guide explains who the rule covers, the controls it requires, and a practical path to alignment.

July 14, 2026 8 min read

Read the Article

A clinical workstation handling protected health information securely.

Business Technology BlogCompliance

A Practical Guide to the HIPAA Security Rule

The HIPAA Security Rule sets administrative, physical, and technical safeguards for electronic protected health information. This guide translates it into practical terms for healthcare practices and business associates, explains required versus addressable specifications, and shows why the security risk analysis is the foundation.

July 14, 2026 8 min read

Read the Article