Cybersecurity & Risk

You don’t need to understand every cybersecurity tool your business uses. But there are a few questions you should be able to get a clear answer to. 

Is MFA turned on? Are your backups working? Are computers getting updated? Does your team know what to do with a suspicious email? And if something unusual happens, who is actually paying attention? 

If the answer to some of those is “I’m not sure,” that’s a good place to start. 

Here’s a straightforward cybersecurity checklist for businesses in Omaha, Lincoln, Council Bluffs, and the surrounding area.

1. Is MFA required on important accounts? 

Check: Can employees access email, financial systems, or other important business applications with only a password? 

If they can, turn on multi-factor authentication (MFA). 

MFA requires another form of verification in addition to a password. That means a stolen password alone usually isn’t enough to get someone into an account. 

At minimum, look at: 

• Microsoft 365 or Google Workspace 

• Accounting and financial applications  

• Remote access and VPN accounts 

• Administrative accounts 

• Other systems containing sensitive business or customer information

 Where available, consider stronger options such as passkeys or security keys. 

2. Are computers and applications being updated? 

Software updates aren’t just about getting new features. They frequently fix known security problems. 

The important question isn’t whether employees occasionally click Update. It’s whether your business has a consistent process for keeping devices and applications current. 

• Operating systems receive security updates 

• Business applications are kept current 

• Browsers are updated 

• Network equipment and other business technology receive appropriate updates 

• Someone is responsible for identifying devices that fall behind 

If updates depend entirely on employees remembering to install them, there’s room for improvement.

 3. Do you know your backups actually work?

Most businesses will confidently say they have backups.

The better question is: When was the last time you tested one?

A backup is useful only if you can recover what you need from it.

• Important business data is backed up

• Backups run automatically

• Backup failures are reviewed 

• Restore tests are performed periodically 

• You know how long recovery would realistically take 

If nobody can remember the last successful restore test, put this one near the top of your list.

4. Are passwords being handled properly? 

You don’t need an elaborate 20-page password policy. You do need some basic rules that everyone follows. 

• Employees use unique passwords for work accounts 

• Passwords aren’t shared through email, Teams, or sticky notes 

• A business-approved password manager is available 

• A business-approved password manager is available 

• Shared or administrative credentials are controlled 

• MFA is used wherever possible

The policy only matters if it reflects what people actually do.

5. Does your email have protection beyond the inbox? 

Email remains one of the easiest ways to get in front of an employee. 

Fake invoices, password-reset notices, Microsoft 365 login pages, messages that appear to come from an executive, and requests to change payment information can all look convincing. 

Your email system should have tools in place to identify and filter suspicious messages before employees ever see them. 

But filtering isn’t perfect—which brings us to the people using it.

 6. Does your team know what to do with something suspicious?

Security awareness training doesn’t need to mean sitting through the same hour-long presentation every year. 

Short, practical training throughout the year is generally more useful. 

Employees should know:

• How to recognize common phishing attempts

• Where to report a suspicious message 

• What to do if they accidentally click something 

• Not to approve an unexpected MFA request 

• How to verify unusual requests involving money or sensitive information

That last one is especially important. 

If someone receives an email asking them to change banking information, send a wire, buy gift cards, or provide sensitive employee information, verify the request another way. Call a known number or speak to the person directly rather than using the contact information provided in the message. 

7. What happens if someone clicks the wrong thing? 

Mistakes happen. What matters next is how quickly your business knows about them. 

Employees should know exactly who to contact if they:

• Click a suspicious link 

• Enter a password on a questionable website 

• Approve an MFA request they didn’t initiate 

• Open a suspicious attachment 

• Notice unusual activity on their computer or account 

You want people reporting those situations immediately—not spending an hour worrying that they’ll get in trouble.

8. Is anyone actually watching your security systems? 

Security tools can generate warnings about things like unusual logins, failed backups, missing updates, or systems that suddenly stop checking in. 

But an alert doesn’t accomplish much if nobody reviews it. 

Ask:

• Who reviews security alerts? 

• Who checks backup failures? 

• Who identifies computers missing important updates? 

• Who investigates unusual login activity? 

• Who is responsible for responding when something needs attention? 

You don’t necessarily need someone staring at a dashboard around the clock. You do need tools watching for problems and a clear process for deciding what happens when they find one. 

The Five-Minute Cybersecurity Check 

If you don’t want to go through the entire list today, start here. 

Ask whoever handles your IT these five questions: 

1. Is MFA required for everyone’s email? 

2. When did we last successfully restore something from backup? 

3. Are all of our computers current on security updates? 

4. What should an employee do immediately after clicking a suspicious link? 

5. Who reviews our security alerts? 

You’re looking for specific answers. 

“We should be.” 

“I think so.” 

“Probably.” 

“Someone gets those alerts.” 

Those aren’t really answers. 

When You Don’t Know the Answers 

Not every business needs an internal cybersecurity department. But somebody needs to own these responsibilities. 

If you went through this checklist and found several questions you couldn’t answer, that doesn’t automatically mean your business has a major security problem. It means you’ve identified what needs to be checked. 

Start there. 

InfiNet works with businesses throughout Omaha, Bellevue, Council Bluffs, Papillion, Lincoln, and surrounding communities to understand what protections are already in place, identify gaps, and prioritize what actually needs attention. 

You don’t need to become a cybersecurity expert. You just need to know the right questions to ask. 

Need help getting those answers? Let’s talk. 

Frequently Asked Questions 

What is the most important cybersecurity step for a business owner to take right now? 

Start by making sure MFA is required for email and other important business accounts. A password by itself shouldn’t be enough to access sensitive systems. Where available, consider phishing-resistant methods such as passkeys or security keys. 

Do I need an IT background to understand my company’s cybersecurity risk? 

No. You don’t need to understand how every security tool works. You should, however, be able to get clear answers about MFA, backups, updates, employee training, monitoring, and who is responsible for each. 

How often should employees receive security awareness training? 

Security awareness works best as an ongoing practice rather than a once-a-year event. Include it during onboarding, reinforce important habits throughout the year, and provide additional guidance when threats or business processes change. 

How do I know whether our backups are good? 

Test them. A successful backup notification tells you the backup process ran; a successful restore tells you that you can actually recover your data. Periodic restore testing is an important part of a reliable backup strategy. 

What does proactive monitoring mean? 

It means using tools to watch for conditions that may need attention, such as unusual logins, failed backups, missing security updates, or security tools that stop reporting. Just as importantly, someone needs to be responsible for reviewing and responding to those alerts. 

When has a business outgrown informal IT support? 

One warning sign is when important questions consistently get uncertain answers. If nobody can confirm whether backups work, updates are current, security alerts are being reviewed, or former employees have lost access, your business probably needs a more defined IT process. 

Do small businesses really need cybersecurity? 

Yes. Phishing, compromised accounts, ransomware, and other threats aren’t limited to large companies. The appropriate tools may differ based on the size and needs of the business, but basic protections matter at any size.

If you’re used to signing into Microsoft 365 and waiting for a six-digit code to arrive by text, that experience is on its way out. 

Microsoft is moving away from SMS and voice calls as preferred methods of verifying sign-ins and pushing users toward more secure options, including passkeys and the Microsoft Authenticator app. 

For businesses, this is less about learning another Microsoft feature and more about making sure employees are ready before their familiar sign-in option changes.

Why Is Microsoft Moving Away From Text Messages?

Text-message verification was a big improvement over using a password alone. The problem is that attackers have gotten better at getting around it. 

SMS codes can be intercepted or stolen through phishing and SIM-swapping attacks. They also depend on your mobile carrier actually delivering the message. Anyone who has stared at a login screen waiting for a code that never arrives knows that isn’t always a given. 

Microsoft now recommends stronger authentication methods that don’t rely on a text message being sent to your phone. 

That includes Microsoft Authenticator, Windows Hello for Business, security keys and, increasingly, passkeys. 

Wait — What’s a Passkey?

A passkey is essentially a replacement for a traditional password that uses something you already have, such as your phone or computer, to verify that you’re really you. 

Depending on the device, that might mean using your fingerprint, Face ID, Windows Hello or your device PIN. 

The important part isn’t the terminology. It’s that passkeys are designed to be much harder for an attacker to steal through a fake login page. 

Microsoft Authenticator can also be part of this experience. The app supports MFA approvals, verification codes, passwordless sign-in and passkeys. 

What Is Actually Changing?

Microsoft has been moving users toward stronger authentication for some time, but there are now some important dates for businesses using Microsoft Entra ID. 

Beginning September 1, 2026, Microsoft plans to start automatically enabling passkey registration prompts for users who are still enabled for SMS or voice authentication. 

Then, beginning February 1, 2027, Microsoft-provided SMS and voice authentication will be retired in Microsoft Entra ID. 

That doesn’t mean everyone’s text-message MFA will suddenly disappear tomorrow. Organizations have time to prepare, and Microsoft provides administrators with options for managing the transition. 

But it does mean businesses shouldn’t wait until employees are confronted with an unfamiliar sign-in screen to figure out what they’re supposed to do. 

What Does This Mean for Your Employees? 

For most users, the biggest change will simply be how they prove it’s really them when they sign in. 

Instead of:

Password → Receive text → Enter six-digit code 

they may use something like: 

Password → Approve sign-in through Authenticator 

or eventually: 

Passkey → Face, fingerprint or device PIN  

Depending on how your Microsoft environment is configured, the exact experience may look different.

And that’s important: businesses shouldn’t tell employees to blindly follow every unexpected authentication prompt they receive. Your IT provider or internal IT team should determine which authentication methods your organization is using and communicate that process to employees.

Why This Is a Good Thing 

Any change to the login process can be annoying at first. From a security standpoint, though, moving away from SMS makes sense. 

Passwords get stolen. Text-message codes can be phished. Attackers routinely create convincing Microsoft login pages designed specifically to capture credentials and verification codes. 

Modern authentication methods make that considerably harder. 

Microsoft is also increasingly using system-preferred authentication, which means that when someone has multiple authentication methods registered, Microsoft can prompt them to use the strongest available option instead of automatically falling back to something weaker.

The goal is pretty simple: make the easiest way to sign in also one of the safest. 

What Should Businesses Do Now? 

You don’t need to panic, and you don’t need to wait until 2027 either. 

This is a good time to have your team review:

• Which employees are still using SMS or voice calls for MFA

• Whether Microsoft Authenticator is properly configured 

• Whether passkeys are appropriate for your organization 

• Which authentication methods are allowed in Microsoft Entra ID 

• How employees will be notified and trained before their sign-in experience changes 

• What your recovery process looks like when someone loses or replaces a phone 

A little preparation now can prevent a lot of “I can’t get into my email” calls later.

MFA Isn’t Going Away — It’s Getting Better

The takeaway isn’t that Microsoft is getting rid of multi-factor authentication. 

Quite the opposite. 

Microsoft is moving away from some of the older ways of doing MFA and toward methods that are harder for attackers to steal, intercept or trick users into handing over.

If your business still relies heavily on text-message codes, now is a good time to review how your Microsoft 365 accounts are protected and start preparing employees for what’s coming. 

Not sure which authentication methods your organization is currently using? InfiNet Solutions can review your Microsoft 365 security configuration, identify users still relying on older authentication methods and help you plan the transition without turning it into a company-wide login headache. 

It’s the third Tuesday of the quarter, and an email lands in every inbox with the subject line, “Mandatory Security Training – Complete by Friday.” You can practically hear the collective groan roll through the office. 

Everyone clicks through the slides, guesses their way through the quiz, and moves on with the day. Then a convincing invoice request arrives two months later, and the employee facing it has never practiced what to do in that moment. 

If that sounds familiar, you have not failed at cybersecurity. You may simply be relying on a training model designed to document completion instead of build better habits. For businesses in Omaha, Lincoln, and Council Bluffs, the goal is not to make employees cybersecurity experts. It is to help them recognize suspicious activity, slow down, and report it quickly. 

Why Most Security Training Falls Short 

A long annual presentation may satisfy an administrative requirement, but it gives employees very little practice. The Federal Trade Commission recommends reinforcing security messages with periodic refreshers and updates, rather than treating training as a one-time event. 

Most employees are moving quickly, switching between tasks, answering customers, approving invoices, and trying to keep work on schedule. A realistic phishing message is designed to take advantage of that pace. 

The 2026 Verizon Data Breach Investigations Report found that the non-intentional human element was present in 62% of breaches. That does not mean people are the only security problem. It does mean employee decisions remain an important part of the risk picture, alongside technical weaknesses and criminal tactics. 

A large 2026 benchmark from KnowBe4 shows what repeated practice can change. The report analyzed 42 million simulated phishing tests across 14.8 million users at 64,000 organizations. Its average Phish-prone Percentage was 33.2% before training, 20.1% after 90 days, and 4.2% after one year of ongoing training and testing. These are vendor customer benchmarks, so every organization will not see identical results, but the direction is clear: consistent practice is more useful than a once-a-year reminder. View the 2026 benchmark source. 

Build a Security Culture, Not Just a Completion Record 

Security awareness is not a course employees finish once. It is a set of habits the organization reinforces, and leadership sets the tone. 

• Leadership participates. Owners and managers complete the same training and follow the same verification steps as everyone else. 
• Reporting is treated as a win. Thank employees who flag suspicious messages, even when the message turns out to be legitimate. 
• High-risk requests get a second check. Wire transfers, payroll changes, gift card requests, and unusual account updates should be verified through a known phone number or established process, not by replying to the message. 
• Security habits stay visible. Password manager use, careful review of multi-factor authentication prompts, safe handling of personal devices, and quick reporting should appear in regular reminders and team conversations. 

Done well, this stops feeling like another training assignment. It becomes part of how the team works. 

What to Measure Over Time 

A completion percentage tells you who opened the training. It does not tell you whether employees are becoming faster or more confident at recognizing risk. 

• Phishing engagement rate. How many employees clicked, opened an attachment, entered information, or otherwise interacted with a simulation? 
• Reporting rate. How many employees used the reporting process, and how quickly did they report? 
• Repeat behavior. Are the same people making the same mistake, or are they improving after coaching? 
• Simulation difficulty. Was the test easy, moderate, or difficult for the intended audience? Use that context before comparing one campaign with another. 

The goal is not a perfect score. The goal is steady improvement and faster reporting when something looks wrong. 

What This Looks Like With the Right IT Partner 

Security awareness training is just one piece of a comprehensive cybersecurity strategy. The most effective organizations take a layered approach that combines people, processes, and technology to reduce risk and improve resilience. 

A trusted managed IT partner should help implement and maintain the technical safeguards that support your business, including: 

• Identity and access management  
• Endpoint protection  
• Email security  
• Regular patching   
• Secure backups  
• Continuous monitoring  
• Vulnerability management  
• Incident response plan.  

Together, these layers help prevent attacks, limit their impact, and support a faster recovery when incidents occur. 

Technology alone isn’t enough, and neither is training alone. Lasting cybersecurity comes from combining informed employees with well-designed systems, thoughtful policies, and ongoing guidance that evolves alongside today’s threats. The result is a security program that protects your business without getting in the way of the people who keep it running. 

Frequently Asked Questions 

How often should employees complete security awareness training? 

There is no universal schedule for every business. A practical starting point is short monthly refreshers paired with regular simulated phishing tests, then adjust the cadence based on employee roles, risk, and results. The important part is consistent reinforcement, not one long annual session. 

Does phishing simulation training actually work? 

It can, when it is part of an ongoing program. In KnowBe4’s 2026 customer benchmark, the average Phish-prone Percentage moved from 33.2% before training to 20.1% after 90 days and 4.2% after one year of training and testing. Those results are not a guarantee for every organization, but they support the value of repeated practice and measurement. See the source data. 

What should happen when an employee clicks a simulated phishing email? 

Provide quick, private, judgment-free coaching. Explain the clues in the message, show the correct reporting process, and give the employee a chance to practice again. Public callouts can make people less willing to report a real mistake. 

How long does it take before training starts showing results? 

Results vary, but the KnowBe4 benchmark showed a measurable change within the first 90 days and a much lower average engagement rate after one year. Track your own baseline and trend instead of assuming a published benchmark will match your organization exactly. 

Is a slide deck enough to meet compliance or cyber insurance requirements? 

Requirements vary by industry, framework, contract, and insurance policy. A slide deck may document that training occurred, but it may not satisfy requirements for recurring education, testing, reporting, or proof of completion. Confirm the exact requirements that apply to your business with the appropriate compliance, legal, or insurance resource. 

What topics should security awareness training cover besides phishing? 

Include password and multi-factor authentication habits, payment and payroll verification, safe use of personal devices, handling of sensitive information, physical security, and how to respond to suspicious texts, phone calls, collaboration messages, or AI-generated impersonation attempts. 

Can training replace other cybersecurity tools? 

No. Training reduces avoidable mistakes, but it does not replace technical protections. The strongest approach combines employee awareness with multi-factor authentication, secure email controls, monitored backups, patching, endpoint protection, and proactive network monitoring.