QPC Security - Breakfast Bytes

Felicia King opens Breakfast Bytes with a crisp, urgent story: a company bruised by a breach not because of a clever hacker, but because leaders treated security as optional. Through vivid scenes—a retiring bookkeeper who leaves a maze of undocumented systems, a CEO who refuses a company password manager, and an ERP implementation missing multi-factor controls—she shows how small shortcuts become catastrophic blind spots.

As the episode unfolds, listeners follow a clear, human arc: confusion and friction during staff transitions, the slow drip of ignored reviews, and finally the explosive cost when problems collide. Felicia contrasts the chaos with a calmer alternative—simple, funded policies, documented roles, and routine oversight—that delivers resilience and saves money.

By the end, you’ll see cybersecurity not as an expense but as a story of stewardship: who chooses convenience over continuity, and who decides to build a legacy of preparedness. Tune in to learn the concrete steps that turn vulnerability into advantage.

Felicia discussed the financial benefits of proactive security practices for both organizations and individuals, emphasizing that preventive measures are significantly more cost-effective than dealing with breaches. She highlighted how decisions like refusing to use company password managers can lead to business continuity and security issues, and she specifically criticized executives who prioritize convenience over organizational security. 

Felicia discussed the importance of secure credential management in organizations, particularly for functions that may need to be performed by multiple people. She emphasized that simply sharing passwords is no longer an acceptable security practice, as modern systems require more complex access mechanisms beyond just passwords. Felicia also highlighted that even administrators may struggle to access systems due to knowledge gaps, not security restrictions.

Felicia discussed the challenges of transitioning roles when employees leave an organization, particularly highlighting the importance of maintaining an inventory of systems used by departing employees to ensure smooth onboarding of new hires. She emphasized that transitions should be coordinated collaboratively, often requiring overlap periods and dual compensation, rather than relying solely on manual cross-training methods. From a business continuity perspective, Felicia advocated for organizational management to fund these transition efforts.

Felicia discussed the importance of proper role documentation and business continuity planning, highlighting gaps she often finds in organizations as their CTO and CISO. She emphasized that proactive approaches to documentation and preparedness are significantly more cost-effective than reactive measures taken after breaches occur.

Felicia emphasized that preparedness is not discretionary but rather a cultural and competitive advantage that enables agility and resilience. She highlighted how companies lacking basic security measures like wire transfer policies and password managers create unresolved problems. Felicia specifically discussed how organizations often claim to have multi-factor authentication but likely lie due to inadequate system inventory and documentation processes.

Felicia argued that periodic security reviews should occur at least twice a year rather than annually, citing evidence from a client's ERP system where multiple security gaps were found including lack of multi-factor authentication, undefined roles, and unnecessary administrative access still being held by former employees. She emphasized that periodic reviews are mandatory and should be validated by business people rather than IT alone, as many organizations treat security reviews as discretionary when leadership doesn't prioritize them.

Felicia discussed the importance of business oversight in IT operations, arguing that delegating responsibility without proper oversight is ineffective. She proposed using business-side personnel, such as the CFO or VP of Sales, to take an oversight role rather than relying on external auditors. Felicia recommended rotating these oversight responsibilities to ensure business continuity and risk management.

Felicia explained that organizations need to build their own policies and procedures with internal employees who take ownership of maintaining and updating them regularly. She noted that outsourced IT services, including CIO services from managed service providers, typically don't provide sufficient remuneration for building internal business resources that the organization truly owns. Felicia emphasized that while IT service providers may be capable of helping with policy development, the current pricing models like bundled managed services plans don't adequately compensate for this type of work.

Felicia discussed the importance of proper oversight in IT services, emphasizing that business leadership must actively engage as informed decision-makers rather than delegating responsibilities without involvement. She highlighted that the success or failure of IT initiatives often depends on whether executive leadership takes a hands-on approach or adopts a "delegate and abdicate" mindset. Felicia based her observations on three decades of experience, noting that business leadership's attitude toward IT oversight significantly impacts organizational progress.

Felicia discussed the challenge of executive leaders who, despite being smart, often maintain a mindset that prevents them from understanding technical aspects of their organization. She emphasized that CEOs need to learn enough about key business systems like databases to make informed risk management decisions, rather than relying solely on hired experts. Felicia noted that over her 30 years of working with CEOs, those who engage in conversations, read documents, and actively participate tend to be more successful in understanding these technical aspects.

Felicia discussed how organizations' knowledge bases grow over time, making their decisions more informed and harder to deceive. She explained that sending queries to multiple IT companies without properly defined requirements can lead to inaccurate solutions based solely on price or personal preference rather than competency. Felicia shared an example from 2021 where she identified an inaccurate server quote in a competitor's proposal, attributing the error to the sales engineer's lack of technical qualifications.

Felicia discussed the common misconception among executives that IT services providers should offer extensive account management and advisory services without additional compensation. She emphasized that IT providers, especially those not charging $10,000 or more monthly, lack the margin to provide such services for free, comparing it to the expectation of paying for advisory services from CFOs, CPAs, or attorneys. Felicia highlighted the need for clients to be willing to pay for collaborative conversations and informed decision-making with their IT services providers.

Felicia discussed the challenges organizations face when dealing with IT services, emphasizing that the root problem often stems from using the wrong paradigm rather than blaming either the client or the IT provider. She advised that if organizations want to delegate IT responsibilities without active involvement, they should hire a full-time internal IT employee rather than outsourcing. Felicia stressed that outsourcing requires a clear understanding of running an IT department or having proper oversight, as these conversations and decisions take time and resources.

Felicia discussed the advantages of using employees over external vendors for handling certain tasks, emphasizing that vendors are not paid to tolerate unstructured situations. She provided an example of organizations avoiding proper ticketing systems by using Slack instead, which prevents tracking of request patterns and statistical evidence. Felicia explained that Slack cannot effectively handle structured IT support requests like security access reviews or ERP multi-factor authentication checks. Many vendors also will not put up with client personnel behavior that violates policy. Observe all the organizations that have had to post policies and warnings that they have the right to not serve the customer when the customer's behavior is toxic. You see this now in virtually every healthcare, personal care, or professional services arrangement. Organizations with toxic culture problems should exclusively rely on employees to fill their needs.

Felicia discussed the importance of operational maturity and explained why companies should not rely solely on their IT services provider's ticketing system. She compared this situation to other service relationships, arguing that IT providers should not be treated differently from other service providers who don't share their processes or intellectual property. Felicia emphasized that organizations should take responsibility for their systems and policies rather than delegating and abdicating control.

You do not get to require your mechanic to turn over all their documentation and service record notes for vehicle service. You do not own the knowledge. The mechanic owns the knowledge. When you eat at a restaurant, you do not get to go visit the chef and have them explain to you how to prepare the meal. It's ridiculous. Stop treating IT services providers this way. If you want to own documentation or the how to guide, then hire employees and have them build it.

A hidden risk that quietly sabotages businesses and personal data: vendor information-security posture. Sloppy public-facing security can be a silent sales-prevention department and how weak governance lets problems linger for years.

A rapid, objective vendor risk assessment (sometimes as little as $300) can reveal whether a vendor will protect your secrets or cost you thousands in wasted time. Tune in to learn the questions to ask, why you must stop delegating oversight, and how to choose vendors that reduce — not amplify — your risk.

Felicia discussed vendor risk management, specifically focusing on information security risks associated with vendors. She explained how poor vendor risk management can negatively impact both organizations and vendors, where a weak security posture turns off prospects. Felicia emphasized that vendors need to be assessed and maintain a good public-facing information security posture to reduce barriers to doing business.

Felicia discussed the challenges organizations face with their public-facing information security posture, particularly noting that many don't realize how many contacts are not being made through their websites. She explained that professional website management requires significant investment and cannot be outsourced effectively, as it involves comprehensive tracking of website engagement and content performance. Felicia emphasized that outsourcing all website security typically leads to poor results.

Felicia discussed the challenges of seeking low prices from web service providers, which often results in limited and inadequate service scope. She highlighted the importance of operational maturity and vendor risk management, particularly in contexts where vendors might access sensitive data, such as with law firms handling business or individual information.

Felicia discussed the importance of conducting rapid vendor risk assessments, particularly for firms handling sensitive data. She highlighted that excessive access to data by personnel not directly servicing the account is problematic and emphasized the need for limited access even for large organizations. Felicia noted that while AI tools attempt to perform analyses, they are often inaccurate and lack contextual judgment. She suggested investing in assessments, which can cost as little as $300, to ensure the security of sensitive information and recommended looking for indicators of good governance and oversight in organizations.

Felicia compared managing business challenges to a bus driver situation, arguing that when a problem driver is identified, they should be removed from driving the bus rather than being asked to assess themselves. She emphasized that organizations often make the mistake of delegating complex issues to IT personnel without proper independent assessment, which she described as "delegating and abdicating" responsibility. Felicia noted that assessments are relatively affordable, with baseline assessments costing around $300 and more detailed ones around $5,000, while often revealing $100,000 worth of issues in a $10,000 engagement.

Felicia discussed the importance of evaluating companies providing sensitive services, emphasizing the need to assess their information security posture beyond just price and coverage. She highlighted the prevalence of incompetence among service providers and warned against starting the evaluation process with price alone, particularly for sensitive services like insurance. Felicia specifically cautioned against using insurance brokers who may not have adequate information security measures in place.

Felicia discussed security concerns in the insurance industry, highlighting issues with data access controls and authentication at both brokerage and insurance company levels. She explained how inadequate security measures, such as the lack of multi-factor authentication in customer portals, expose sensitive personal information to potential compromise. Felicia questioned the validity of the shared responsibility model, arguing that it shifts blame to consumers for security issues largely beyond their control.

Felicia discussed the challenges of getting reimbursement for identity theft and insurance claims, highlighting how insurance companies create complex and time-consuming processes that can cost victims significantly more than the actual claim amount to navigate. She provided an example of someone who has been trying to recover $11,000 from an insurance company since May but has already spent approximately $20,000 in time and effort due to the company's requirements for documentation and paperwork.

Felicia discussed the importance of conducting thorough vendor risk assessments to understand the potential risks introduced by working with vendors. She questioned the value of casualty insurance and emphasized the need for objective data from experienced professionals to assess vendors' information security postures. Felicia highlighted that many security breaches go unreported, making it crucial to evaluate vendors' capabilities in securing data they hold or process on behalf of the customer.

Felicia King opens Breakfast Bytes by tearing down the myths around QR codes and taking listeners on a clear, human journey: from frustrated users mistyping long cryptographic secrets to the quiet heroism of modern multi-factor authentication. Through real examples—missed SMS messages with dangerous consequences, stolen mail, and the rise of passkeys—she shows why QR codes often solve real problems, not create them.

With an approachable analogy to paper mail, Felicia explains how context, intent, and the tool you scan with determine risk, and why refusing QR codes can cut you off from essential services. This episode is a short, urgent invitation to rethink convenience and security as partners, not enemies.

https://qpcsecurity.com/qr-codes-are-not-the-problem-understanding-the-difference-between-convenience-and-risk/

Felicia discussed the importance of addressing misperceptions about QR codes, explaining that they are simply graphical encoding formats for storing information such as URLs, phone numbers, or complex data strings. She clarified that QR codes are not complex technology but rather standardized visual formats that can store various types of information.

Felicia explained that people use QR codes in two main categories: for facilitating security through multi-factor authentication and secure enrollment, or for malicious purposes. She emphasized that QR codes themselves are not inherently risky, comparing them to barcodes on products, where the risk comes from how they are used rather than the technology itself.

Felicia discussed the challenges of multifactor authentication, particularly the inconvenience of manually typing long security codes exceeding 256 characters. She emphasized that while security is important, the technology must remain user-friendly to prevent frustration and abandonment. Felicia noted that if users struggle too many times, they will give up, making the alternative solution unacceptable.

Felicia discussed the security concerns surrounding QR codes, comparing them to receiving mail and emphasizing the need to differentiate between trusted and untrusted sources rather than avoiding them entirely. She explained that QR codes are commonly used for multi-factor authentication enrollment from reputable providers like Microsoft 365, Google, and Proton, and noted that SMS-based MFA mechanisms will be phased out starting Q4 2026. Felicia highlighted the unreliability of SMS delivery, particularly in urgent situations, using examples of elderly individuals trying to transmit time-sensitive medical information.

Felicia discussed the security risks of SMS messaging, explaining that it cannot be verified who is sending messages or confirm their delivery, making it "atrociously insecure" and high-risk. She noted that many organizations have moved away from SMS-based authentication, including the Social Security Administration, which switched to the ID.me system with more intensive multi-factor authentication requirements. Felicia suggested that people who prefer not to use QR codes for authentication might need additional training, as digital interaction is increasingly common even for basic activities like email use.

Felicia discussed the evolution of SMS as multi-factor authentication, noting that it was implemented around 2014 but is being discontinued. She explained that modern systems, including those used by the state of Wisconsin, are moving toward more secure authentication methods such as 6-8 digit rolling codes and pass keys. Felicia highlighted that while Microsoft 365 offers sophisticated security features, these are exceptions rather than the standard in most systems, which typically rely on basic username-password combinations with multi-factor authentication.

Felicia explained the difference between safe and risky uses of QR codes, particularly in the context of multi-factor authentication (MFA) enrollment. She clarified that QR codes used for MFA enrollment are secure as they function as graphical representations of cryptographic keys, which should be scanned using authenticator applications like Microsoft Authenticator, Google Authenticator, or password managers. Felicia warned against scanning random QR codes found in advertisements or public places, as these could potentially lead to malicious websites. She also noted that the negative perception of QR codes stems from their association with control mechanisms used during COVID-19, such as contact tracing.

Felicia discussed the importance of understanding shared responsibility models in security, particularly regarding QR codes and multi-factor authentication. She explained that completely avoiding digital systems, including QR codes, is not practical in today's world, as many essential services require digital verification. Felicia provided an example of a stolen tax refund check to illustrate how physical mail can be insecure, emphasizing that digital alternatives like direct deposit are more secure. She concluded by noting that QR codes themselves are not inherently problematic, but rather the source and context of use are important considerations.

Felicia King interviewed Robin Grayson of Redcliffe Technology Services about artificial intelligence in software development. Robin, a programmer with 30 years of experience, discussed the importance of maintaining rigorous software development practices when using AI tools like Claude, emphasizing the need for proper guardrails, documentation, and security reviews. He explained his approach of treating AI-assisted development like working with a highly skilled junior developer, including using Azure DevOps for enterprise applications and setting up markdown files with instructions for AI to follow. Robin highlighted significant security concerns when non-technical people use AI to develop applications without proper oversight, potentially exposing sensitive systems and data to risks. He also discussed the importance of security-first development and using AI for code reviews to identify security vulnerabilities in existing codebases.

https://www.redcliffesystems.com/

Robin discussed the evolution of software development practices, highlighting how developers in the past had to be more meticulous due to limited resources and the absence of modern tools like Stack Overflow. He emphasized the importance of understanding hardware, networking, and security, which many current software developers lack due to their limited exposure to physical infrastructure. Felicia agreed with Robin's points, noting the challenges faced by developers with limited real-world experience in networking and server management.

Robin discussed challenges with software development, particularly when projects are rushed into production without proper planning. He explained his approach to AI development by treating it like a highly skilled junior developer, emphasizing the importance of following proper development processes including isolated branches, pull requests, and code review. Robin highlighted that while some developers adequately review code, others simply approve pull requests without properly examining the changes.

Robin described his approach to integrating AI, specifically Claude, into his software development workflow by establishing clear processes and requirements. He demonstrated this by setting up a DevOps board in Microsoft Azure and configuring Claude to follow specific steps, including accessing the board, moving items through development stages, and creating pull requests. Robin also explained the use of markdown files for documentation, which allows for easy tracking of changes, reviews, and testing evidence within the source control system.

Robin explained that markdown files serve as source instructions and guardrails for Claude's work, making it more efficient than using Word documents and easier for team members to review. Robin also described implementing a system where Claude generates documentation for every change, which is checked in alongside pull requests for team review. The discussion concluded with Robin expressing concerns about "vibe coding" where non-technical users create applications without understanding the security implications, leading to potential security vulnerabilities like hardcoded credentials in source control.

Felicia and Robin discussed the importance of proper guardrails and instructions when using AI for code development assistance to prevent security risks. Robin highlighted concerns about developers giving AI systems excessive permissions without understanding the implications, while Felicia emphasized the need for better oversight processes, particularly regarding third-party information security risks when businesses use external partners' services. Both agreed that the current lack of proper review and consent processes creates significant security vulnerabilities when non-developers implement and deploy applications connected to critical systems like Microsoft 365 tenants.

Felicia and Robin discussed governance oversight and regulatory requirements around data security and disclosure in the UK and US. They highlighted the severity of failing to disclose material security facts, referencing regulations like GDPR and FTC regulations, and emphasized the importance of security in software development, particularly with AI and IoT devices. The conversation ended with Felicia asking Robin about their thoughts on using Azure DevOps versus GitHub, but this part of the discussion was not captured in the transcript.

Robin advised using Azure DevOps for closed-source enterprise applications and GitHub for open-source projects. When asked about application security assessment, Robin suggested using AI tools like Claude with appropriate security standards and noted that AI can perform comprehensive security reviews of code bases, though it's important to monitor token usage during these reviews.

Robin reviewed the source code and identified top issues that need immediate fixes, along with additional concerns to address in the future. Felicia expressed appreciation for the discussion about empowering developers with AI capabilities, noting how this could help overcome limitations in existing third-party tools. 

Felicia King opens Breakfast Bytes with two vivid vendor-vetting stories: a positive case involving a law firm engagement where clear communication and economic impact assessment resolved concerns before moving forward, and a negative case involving a UK-based consultancy reselling SaaS licenses where fraudulent billing practices occurred.

Through these contrasting narratives—responsive attorneys who clarified costs versus a buggy reseller that billed months later—Felicia lays out the simple, powerful checks that prevent disputes: ask scenario questions, demand sample invoices, review service-attach schedules and data subprocessors, and get commitments in writing. Remember: payment is acceptance; lack of payment is lack of consent.

Short, practical, and sharply told, this episode gives you the red flags to watch for and the exact questions to ask so you never get stuck paying for a service you never agreed to.

Felicia emphasized the importance of reviewing vendor agreements carefully, asking scenario-based questions about billing processes, requesting sample invoices, understanding data subprocessors, and payment collection methods. She stressed that legitimate businesses should disconnect services immediately when payment is not received, avoid using collections agencies, and provide clear renewal processes, warning that red flags include unclear billing terms, hidden auto-renewal clauses, and refusal to share service attached schedules.

Felicia discussed vendor risk pre-assessment and billing discrepancy issues, using a personal injury law firm case as an example of effective vendor vetting. She described how they developed criteria to evaluate law firms, scheduled calls, reviewed agreements, and addressed unclear terms regarding reimbursable expenses. The process included engaging with the attorney and their staff to clarify costs and ensure alignment before moving forward with the engagement.

Felicia discussed a negative experience with a UK-based consultancy that was reselling software licenses and providing consulting services to U.S. companies. She identified a key red flag that should have prompted ending the engagement: a disconnect between the consultancy and their software vendor, including conflicting requests about demo data in the tenant. Felicia noted that these issues could have been detected earlier to avoid problems.

Felicia discussed issues with a software vendor from the UK that had numerous bugs and problematic billing terms. She explained that the vendor's billing agreement allowed them to bill customers irregularly and potentially not at all, which is unacceptable for month-to-month services in the United States. Felicia highlighted examples of confusing invoices with identical service terms but different invoice numbers, describing this as intentional misrepresentation. She recommended that companies should ask potential vendors about their billing practices before starting business relationships.

Felicia discussed billing practices and payment policies for IT services, explaining that services are turned off when payment is not received and emphasizing the importance of clear invoicing and consent. She advised reviewing vendor agreements, asking scenario questions, and obtaining sample invoices to ensure transparency. Felicia also highlighted the significance of reviewing service attached schedules to understand third-party risk management and data subprocessors in the supply chain.

Felicia discussed the importance of transparent billing practices and payment structures in vendor relationships. She emphasized that the use of collections agencies should be a red flag, particularly for smaller consulting firms, as it often indicates poor business practices or fraudulent billing. Felicia recommended a straightforward approach where services are billed upfront or monthly, with disconnection if payment is not received, and suggested providing 90-day advance notice for renewals.

Felicia discussed the importance of understanding vendor policies for non-renewal processes, emphasizing that vendors should make it easy for customers to self-manage if they don't want to renew. She highlighted the need to inquire about data handling when services are discontinued due to non-payment, warning that some vendors may retain customer data even after services are turned off, which she described as mismanagement.

Join Felicia King on Breakfast Bytes as she exposes the broken paradigms behind how small and medium businesses manage their websites. Through clear, hard-earned advice and real-world examples, she shows why handing everything to a web vendor leads to lost continuity, failed deliverability, and missed sales — and how a shared-responsibility approach with the right CTO and tools restores control and effectiveness.

From domain ownership and DNS to WordPress hosting, contact-form delivery, and email authentication (DMARC, DKIM, SPF), Felicia walks listeners through the practical steps to secure and optimize a website that actually connects with prospects. Whether you’re deciding between affordable managed WordPress plans or choosing the right frameworks, you’ll leave with a framework for ownership, documentation, and a small, sustainable maintenance plan that preserves business continuity and boosts outcomes.

Felicia discussed the common challenges small to medium businesses face with their websites, emphasizing that it's a paradigm issue rather than just a vendor selection problem. She identified key concerns including business continuity, ownership, and understanding risk associated with websites as critical public-facing organizational presence. Felicia noted that past paradigms for website management no longer work effectively and haven't been functional for at least the last six years.

Felicia discussed website effectiveness and shared insights about what doesn't work well, mentioning Matt Diggity as an authoritative resource on website optimization. She explained that website effectiveness involves connecting with prospects, accurately representing the organization's activities, and facilitating business objectives like email marketing and CRM systems. Felicia specifically highlighted that contact forms are often problematic and can reveal inadequate technology providers or website consultants.

Felicia strongly advised against having website development or management companies host domain and DNS, warning that this creates migration issues and potential problems if separating from the company. She emphasized her 30 years of experience in recommending that domain and DNS hosting should be either internally owned or managed by a chief technology officer rather than outsourced to web development companies.

Felicia discussed the benefits of using WordPress as a content management system, highlighting its market share and security improvements. She emphasized that businesses should own their WordPress.com accounts rather than paying monthly fees to manage basic features like automated backups and security. Felicia recommended quarterly check-ins with a CTO for website health monitoring and suggested a total annual cost for website hosting and tooling ranging from $1,200 to $3,000.

Felicia discussed the importance of maintaining direct involvement in website management rather than delegating it entirely to others, emphasizing that outsourcing key aspects like SEO is ineffective due to constant changes in the field. She highlighted the benefits of using WordPress.com, including built-in features like WooCommerce and Stripe integration, which are not commonly promoted by web developers whose business model relies on delegation. Felicia also warned about the potential negative impact on website performance when switching to third-party services, citing examples of companies whose statistics declined after using website mills.

Felicia discussed the importance of having effective contact forms on websites, emphasizing the need for proper email deliverability and anti-spam protections. She highlighted common issues with third-party web developers' inadequate handling of DMARC, DKIM, and SPF configurations, which can lead to undelivered emails. Felicia also criticized the use of certain email services like SendGrid, suggesting they are poorly configured for effective communication.

Felicia discussed email deliverability issues, specifically highlighting problems with a website using SendGrid for multi-factor authentication (MFA) that resulted in 100% undeliverable emails due to improper implementation. She emphasized that most organizations fail basic email security standards like DMARC, DKIM, and SPF, and criticized the widespread technical incompetence in email deliverability management despite these standards being established over a decade ago.

Felicia discussed the importance of AI search optimization for websites and criticized the practice of delegating website management entirely to external third parties. She argued that spending significant monthly fees on SEO management without proper expertise or results constitutes fraud, describing it as a "dead paradigm." Felicia emphasized that business owners should remain involved in their website management rather than abdicating all responsibility to external companies.

Felicia discussed the importance of a shared responsibility paradigm for website management, emphasizing that outsourcing everything or trying to do it all independently doesn't work effectively. She explained that the ideal approach involves working with a CTO on a project to set up the website, with monthly check-ins to support internal team members in learning SEO and content management. Felicia stressed the need to start with clear requirements before seeking proposals from vendors and highlighted the importance of maintaining a professional public-facing security posture through proper website and email configuration.

Felicia King pulls back the curtain on Windows 365 Cloud PCs and takes you on a journey from the chaos of shipping laptops to the precision of cloud-hosted workstations. Through real-world examples—remote hires across continents, a surveillance system rescued from theft, and the thorny case of legacy apps—she shows how moving the PC to the cloud transforms logistics, security, and performance.

The episode dramatizes the stakes: stolen hardware, data exfiltration, and transatlantic latency versus a low-latency Microsoft backbone, regional Cloud PC placement, and tight policy controls. Felicia balances costs, practical limits (hello, South Africa), and alternatives like Azure Virtual Desktop, turning technical tradeoffs into human-centered decisions.

Listen in for clear, no-nonsense guidance, vivid field-tested anecdotes, and a final note: the right rollout needs networking wizards. If you manage remote teams or sensitive data, this episode reframes what a desktop can be—and what it should cost you to keep your business safe.

Felicia King discussed Windows 365 Cloud PCs, explaining their costs, use cases, and limitations. She outlined that Cloud PCs are suitable for remote workers, particularly those in foreign countries, as they allow for better performance and security without the need to deploy physical hardware. Felicia highlighted the importance of selecting the correct region to minimize latency and discussed the challenges of using Cloud PCs in areas like South Africa due to poor connectivity. She also explained the benefits of using Azure Virtual Desktop for larger-scale deployments or legacy applications requiring Active Directory. Felicia emphasized the security advantages of Cloud PCs, including the ability to control network connections and prevent data exfiltration, and suggested that they could be a cost-effective solution for remote workers when combined with devices like the Microsoft 365 Link.

Felicia discussed Windows 365 Cloud PCs, explaining that they are cloud-based computers accessible only through a business's Microsoft 365 tenant and Azure Active Directory. She noted that the baseline cost for a suitable business implementation is over $2,000 per year, requiring proper management and maintenance. Felicia mentioned that Windows 365 Cloud PCs are particularly beneficial for remote workers in business environments.

Felicia discussed the challenges organizations face with remote working, particularly regarding equipment deployment and recovery for employees in different countries. She explained how Windows 365 cloud PCs could address these issues by allowing organizations to host virtual desktops in region-specific data centers, which would improve performance and reduce latency for remote workers.

Felicia discussed the benefits of positioning cloud PCs in regions near workers, explaining how this reduces latency and improves performance. She emphasized the importance of being on the Microsoft backbone for enhanced connectivity to Microsoft services and other cloud resources. Felicia noted that while this approach significantly improves performance, there is currently no South Africa region available for Windows 365 cloud PCs.

Felicia explained that Microsoft cannot currently make Microsoft Teams work effectively for South Africa due to poor connectivity between South Africa and the United States, with data routes going through Europe or taking a high-latency route through Brazil. She noted that Azure Virtual Desktop could be a solution but only becomes economically feasible for 15-20 endpoints or more, requiring significant administrative overhead. Felicia identified two main use cases for Azure Virtual Desktop: when organizations need large quantities of low-latency workstations close to users, or when they are using legacy technology requiring Active Directory like Great Plains or Solomon systems.

Felicia discussed the limitations of Windows 365 Cloud PCs, noting that they cannot be joined to Active Directory unlike Azure Virtual Desktop. She explained her current use of Windows 365 Cloud PC for printing and accessing on-premises resources through custom networking and secure edge agents. Felicia also shared an example of using cloud servers for a business that wanted to avoid on-premises hardware after experiencing a break-in, implementing a solution with microSD card caching for camera recordings.

Felicia explained the implementation of a Windows 365 cloud PC for a customer, which provides secure high-performance access to their video management system and other applications from anywhere. She described how this solution allows users to access a full desktop experience from any device while maintaining security through restrictions on copy-paste functionality between the local and cloud environments. Felicia noted that while complete data security is impossible, the cloud PC provides significant protection against data exfiltration compared to traditional local computing.

Felicia discussed the benefits of cloud PCs, highlighting their security features and ease of management compared to traditional hardware. She introduced Microsoft 365 Link, a new device with a downsized operating system priced around $400 with an optional $100 warranty, which can support up to two monitors. Felicia explained that these devices can be accessed with Microsoft 365 accounts, similar to Google Workspace.

Felicia discussed the use case for Windows 365 cloud PCs, particularly for remote workers, emphasizing enhanced security and control over data and network connections. She explained how cloud PCs can mitigate risks associated with data exfiltration and hardware security, especially for sensitive roles like accounting. Felicia noted that while cloud PCs may be more expensive than traditional hardware, they offer better security and compliance benefits and suggested using them in conjunction with Microsoft 365 Link PCs for remote workers.

Host Felicia King sits down with Rick Hernandez, CEO of N2Con, to unravel a common but dangerous IT story: assessments that miss the point and audits that leave companies exposed. Through candid examples—lost laptops, stale Active Directory entries, and policies that never existed—they set the stage for a real-world investigation into how businesses really manage (or mismanage) their digital assets.

As the conversation deepens, the tension grows: accounting firms deliver check-the-box reports, old tools miss cloud realities, and well-meaning assessments become expensive paperweights. Felicia and Rick walk listeners through the messy discoveries they encounter when onboarding clients, and the moment when a seemingly small gap in inventory can lead to a major security and financial risk.

Instead of one-off reports, the episode offers a roadmap—pick a practical framework, insist on executive buy-in, adopt continuous vulnerability management, and own your asset and compliance data. Short, vivid, and tactical, this episode turns audit horror stories into clear next steps for any organization ready to take responsibility for its security.

Felicia King and Rick Hernandez discussed challenges around assessments and audits in cybersecurity, particularly focusing on the issues that arise when clients approach MSPs after undergoing assessments with accounting firms. They explored how many organizations lack proper asset inventories and off-boarding processes for equipment, leading to security gaps and compliance challenges. The conversation highlighted the problems with one-time security assessments, with both speakers agreeing that a more effective approach involves implementing continuous monitoring tools and establishing proper frameworks like NIST or CMMC before seeking external assessments. They discussed how many organizations waste money on incomplete assessments from firms lacking proper cybersecurity expertise, and emphasized the importance of executive buy-in and proper risk prioritization for successful security implementations.

Felicia and Rick discussed challenges with asset inventory and management in businesses. They highlighted the importance of having an accurate inventory for security purposes and noted that assets are often tracked in various systems, including accounting, spreadsheets, and ticketing systems. They also addressed the issue of tracking assets allocated to employees, particularly when they leave the company, emphasizing the need to reclaim company property, especially devices containing sensitive data.

https://www.watchguard.com/wgrd-security-hub/secplicity-blog/security-gap-lets-attackers-walk-right

Rick and Felicia discussed the implementation of a new policy regarding equipment disposal and data security. The policy now requires proper wiping and decommissioning of equipment before it can be given to departing employees, who can then purchase it if desired. They emphasized that the previous approach of simply giving equipment to employees without proper data wiping was ineffective and potentially harmful to the company's data security.

Felicia and Rick discussed the importance of maintaining an accurate asset inventory and proper off-boarding processes for systems. They highlighted how common it is to find stale data and unmanaged assets in systems like Active Directory and Bitdefender platforms, often due to lack of formal off-boarding procedures. Felicia emphasized that an asset management platform can be cost-effective and significantly improve system maintenance efficiency.

Felicia and Rick discussed the importance of maintaining accurate IT asset inventory and lifecycle tracking, emphasizing that relying solely on IT vendors for documentation is insufficient. They highlighted how understanding equipment lifecycles can help IT managers forecast future replacement costs and plan accordingly. The conversation then shifted to addressing challenges when dealing with clients who approach Managed Service Providers (MSPs) after undergoing formal assessments or audits conducted by accounting firms, with Felicia noting the need to distinguish between assessments and audits in the IT context.

Rick and Felicia discussed the limitations of traditional security assessments conducted by accounting firms and less experienced providers. They agreed that many existing assessment tools and methods are outdated, particularly in modern cloud environments where traditional network discovery techniques no longer work effectively. Both expressed skepticism about the reliability of assessment data from less experienced firms, with Rick noting he always questions the tools used in such assessments.

Rick and Felicia discussed issues with assessment reports, particularly when the scope and intent of the assessment are unclear. Rick explained that while this information might be found in the initial statement of work, it's not typically included in the final report, which can lead to questions about the report's legitimacy. Felicia expressed concern about the lack of clear scope information in reports, describing the situation as potentially indicating "amateur hour" work.

Felicia and Rick discussed their concerns about assessment approaches, with Felicia expressing that she prefers a focused risk-prioritization method rather than comprehensive audits. They agreed that organizations typically already know their major risks, and leadership interviews can quickly identify key concerns. The conversation ended with them beginning to discuss how to approach clients who come seeking help after an audit, though the specific details were not captured in the transcript.

Felicia and Rick discussed common scenarios where organizations seek help after conducting initial assessments with other firms that lacked proper implementation expertise. Rick explained that when clients approach his team, they often have gaps in their previous assessments and have become overwhelmed. They both emphasized the importance of executive management buy-in for successful implementation of security controls, with Rick noting that his team will walk away if they don't have proper support from the top leadership.

Rick and Felicia discussed the importance of proper cybersecurity framework implementation and the pitfalls of one-time vulnerability assessments. They agreed that organizations should first establish a policy and framework, then implement continuous monitoring tools rather than paying for external assessments. Felicia emphasized that organizations should own their tools and processes, while Rick acknowledged that most IT personnel and MSPs lack the security expertise to properly implement complex controls without creating additional risks.

Join CTOs Felicia King and Shimon Magal for a candid, off-the-cuff conversation that pulls back the curtain on Microsoft Secure Score. They explore its strengths and sharp limitations—where it guides security improvements, where it pushes licensing, and why it falls short for real compliance and legal attestation.

Through real-world MSP and enterprise scenarios, they reveal the importance of risk-prioritized, continuous configuration management, explain how compensating controls and human workflows matter, and outline why non-tamperable reporting and the right licensing are critical. Whether you’re an MSP or an in-house security leader, this episode challenges assumptions and offers a practical roadmap to turn Microsoft security metrics into defensible, actionable posture management.

Shimon is the CTO for Optimize365.io https://www.optimize365.io/

Shimon and Felicia discussed the limitations of Microsoft's Secure Score tool, which Felicia described as being Microsoft-centric and not providing comprehensive compliance reports. They agreed that while Secure Score could be useful as a baseline assessment, organizations need more specific controls for compliance with frameworks like CIS, NIST, or HIPAA. Felicia emphasized that the tool's accuracy is crucial for meaningful risk assessment, though she acknowledged that technology assessments must evolve as the tools themselves change.

Shimon and Felicia discussed the limitations and challenges of Secure Score, a Microsoft tool for assessing security posture. They highlighted that Secure Score's scoring system is not equally weighted across all aspects, making it difficult for organizations to improve in specific areas. Felicia emphasized that Secure Score is primarily used to sell more Microsoft licensing rather than providing meaningful insights for improving security. They also discussed the importance of generating legal attestation reports and tracking changes over time, which Secure Score does not support effectively. Felicia suggested the need for a more comprehensive assessment platform that can produce meaningful reports, facilitate workflows, and provide a customer-facing portal for better visibility and control.

Felicia and Shimon discussed the limitations of Secure Score, noting that it does not account for complementary tools or manual processes, which are crucial for compensating controls. They emphasized the importance of incorporating both technical and human components into risk-prioritized assessments and attestation workflows.

Felicia expressed deep concern about MSPs using Secure Score as a fee-based service without generating legally valid attestation reports, emphasizing the importance of non-tamperable documentation for legal proof and compliance. She highlighted the need for automated systems to generate and publish reports to a secure repository, ensuring retention policies align with legal requirements. Shimon agreed on the shortcomings of Secure Score for MSPs and the need for a robust workflow that includes documentation repositories to meet business and legal needs.

Felicia discussed the importance of having the right licensing, such as Entra IDP2, to access proactive real-time controls and data from Microsoft 365. She emphasized that alerting and diagnostics tools like Petra Security and Optimize can be beneficial for MSPs, but they should not replace Entra IDP2 licensing. Felicia also stressed the need for consistent, regular proactive secure configuration management as a service, not a one-time project, and advised MSPs to ensure their M365 tenants have this service or have explicitly declined it.

On Breakfast Bytes, host Felicia King sits down with Jane Conners—a California attorney with deep expertise in governance, risk, compliance, and the new frontier of AI privacy—to unpack a hidden threat stalking small and medium businesses: asymmetrical contract power. From click‑wrap traps and rogue shadow IT to agentic AI that quietly folds your data into someone else’s model, Jane frames a vivid narrative of how everyday procurement decisions can become serious legal battles.

Through sharp anecdotes and practical rules of thumb—start renewals six months early, demand clear SLAs and exit language, insist on an ‘unlearn’ right, and adopt a stepped early dispute resolution process—Jane maps a fast, pragmatic path out of years‑long litigation nightmares. Tune in to learn how to turn diffuse legal risk into focused strategy and get back to running your business.

Felicia and Jane discussed dispute resolution mechanisms for small and medium-sized businesses (SMBs) in the context of vendor contracts, particularly focusing on asymmetrical bargaining power and the challenges SMBs face when negotiating with larger technology vendors. Jane explained the importance of implementing a structured procurement process and highlighted the benefits of early dispute resolution frameworks, which can help resolve disputes within 100 days through a four-step process involving executive-level negotiations and risk-adjusted value analysis. They discussed specific strategies for SMBs, including negotiating renewal terms 6 months in advance, being cautious with shadow IT that can lead to binding legal traps, and ensuring clear definitions around service security failures versus data breaches in contracts with MSPs and MSSPs. Jane also emphasized the need for SMBs to negotiate the right to "unlearn" their proprietary data from AI systems and to explicitly define liability caps in contracts.

Jane discussed her background in dispute resolution and highlighted the challenges small businesses face when negotiating contracts with SaaS vendors and other service providers. She emphasized the increasing asymmetry in bargaining power, particularly with the rise of agentic AI, and the issue of click-wrap agreements that small businesses often accept without legal review. Jane suggested that small businesses should focus on developing effective strategies to protect themselves from liability and navigate disputes with vendors.

Felicia emphasized the impact of asymmetrical bargaining power in vendor relationships, urging small to medium businesses to develop rigorous procurement policies. Jane shared strategies for negotiating with vendors, highlighting the potential for significant price reductions if renewals are planned six months in advance. She also advised focusing on aspects beyond pricing, such as data privacy and security standards, and emphasized the need for clear exit strategies, particularly in the context of agentic AI.

Jane and Felicia discussed the importance of negotiating clauses for unlearning and controlling costs in business contracts, particularly for enterprise clients and early-stage startups. They highlighted the need for clear processes around procurement to avoid unexpected expenses and risks. Jane also explained the different types of dispute resolution mechanisms available, including mediation, arbitration, and neutral case evaluation, emphasizing the importance of choosing the right process to resolve disputes efficiently.

Jane explained a dispute resolution methodology that aims to resolve cases within 60 days, involving risk-adjusted value analysis and structured negotiations. She highlighted the use of digital first arbitration platforms, including JAMS, which have implemented new rules for AI and machine learning disputes. These platforms help contain technical discovery, manage security, and address unique conflicts related to AI training and utilization.

Jane discussed the challenges and inefficiencies of traditional arbitration and litigation, particularly for small and medium-sized businesses. She highlighted the benefits of early dispute resolution (EDR) frameworks, which involve a structured process to identify issues, assess risks, and facilitate principled negotiations. Jane emphasized the importance of clear contract terms, including specific service level agreements (SLAs) and liability caps, to protect businesses from vendor leverage and unexpected costs. She recommended that businesses review and modernize contracts 6 months before renewals, be vigilant about shadow IT, negotiate stepped ADR processes, and ensure the right to unlearn AI-driven data.