This week on SMB Risk, Chris Foulon breaks down control-plane risk for SMB leaders: CISA KEV activity, exploited SharePoint and remote-support tools, automated-decision compliance, and agentic AI governance. Learn how to spot systems that can act across your business, set a 72-hour response rule, build an automated-decision register, and define where AI can advise, draft, or execute.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

What inside your business can act before a human verifies it? This week, we dive into the convergence of three major tech shifts: the modular infostealer economy, costly regulatory enforcement after ransomware, and the mainstream arrival of computer-using AI agents like Gemini 3.5 Flash.

If you lead tech or cybersecurity for an SMB, this episode provides a localized execution plan to bridge the gap between risk awareness and actual protection. We cover:

Cyber Threats: Why treating browsers, endpoints, and admin sessions as a single identity risk surface is critical to stopping credential theft.

Compliance: How to build an evidence trail that satisfies regulators (like HHS OCR) before a ransomware incident occurs.

AI Governance: Setting up "advise, draft, and act" lanes for AI to prevent unverified execution.

Listen in for the 3 steps you need to take this week to secure your unverified workflows.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

The attack surface is expanding faster than policy. In this week's briefing for SMB leaders, we tackle the convergence of remote-access vulnerabilities and unfinished AI regulation.

Listen in to learn:

Why the Check Point VPN zero-day (CVE-2026-50751) requires an immediate remote access security audit.

What the Colorado AI bill veto means for SMBs using data-driven pricing and wage tools, and why you still need an AI governance framework.

How Apple’s WWDC26 announcements prove consumer AI is now workplace infrastructure, and how to control it before shadow AI takes over.

Don't let speed turn into unmanaged exposure. Listen now to get your strategic action plan, and subscribe to the newsletter for the full technical execution guides and premium leadership toolkits.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

January 2026 Alert: Critical Microsoft Copilot vulnerability (Reprompt), Bluetooth "WhisperPair" exploit affecting Sony/Google devices, and new privacy laws in IN, KY, & RI. Get the executive summary and 30-day mitigation plan for SMBs.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

From building software to defending it: Jason Casey (CEO, Beyond Identity) shares his journey from Software Engineer to Cybersecurity Expert. Discover why mastering network protocols and engineering fundamentals is the secret to a successful cyber career. Listen now on Breaking into Cybersecurity.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

CES 2026 changed the threat landscape. From "Superuser" AI agents to "cute" surveillance robots like Mirumi, we outline the top 4 trends SMB tech leaders must address immediately to secure their organizations.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

Urgent briefing for US SMBs: Critical patches needed for WatchGuard, Fortinet, & Cisco. Discover how to stop AI attacks and avoid $3M breach costs. Read the Urgent briefing for US SMBs: Critical patches needed for WatchGuard, Fortinet, & Cisco. Discover how to stop AI attacks and avoid $3M breach costs. Read the plan.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

CMMC Phase 1 is effective as of Nov 2025. DIB leaders: Get the strategic guide to CUI, VDI, and NIST 800-171 compliance before the 2026 deadline.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

Is your business one tragedy away from collapse? Learn how to mitigate "Key Person Risk" and the "Bus Factor" with our 2025 guide to IT succession planning.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe

The “One-Size-Fits-All” Problem

We’ve all been there. A mandatory, hour-long cybersecurity training video that covers everything from phishing to physical security in a bland, generic way. Your marketing team is half-listening while thinking about their next campaign, and your finance department is wondering how any of this applies to their daily invoice processing.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit substack.cpf-coaching.com/subscribe