Author: Invincia Technologies

Are AI Meeting Note Takers Safe for Business?

AI meeting note takers have gone from novelty to necessity in a remarkably short time.

Today, it’s common to join a Teams, Zoom, or Google Meet call and see an AI assistant automatically recording the conversation, creating a transcript, and delivering a polished summary with action items before the meeting is even out of mind.

The productivity benefits are obvious. Teams spend less time taking notes, follow ups become clearer, and important decisions are easier to track.

The challenge is that many organizations adopt these tools without first considering what happens to the meeting data afterward. Every conversation, including sensitive discussions that would never appear in an email or document, may be recorded, stored, and accessible long after the meeting ends.

For business owners and leaders, it’s important to understand exactly how these tools work before making them part of everyday operations.

What Does an AI Note Taker Actually Do?

An AI note taker joins a meeting, records the conversation, converts speech into text, and creates a summary of key discussion points, decisions, and action items.

Popular solutions include:

• Microsoft 365 Copilot for Teams
• Otter
• Fireflies
• Fathom

Many of these platforms connect directly to users’ calendars and can automatically join scheduled meetings. Depending on the settings, the note taker may attend meetings even when the user who enabled it does not.

The recording doesn’t disappear when the meeting ends.

Instead, the transcript, summary, and sometimes the full recording are stored in the cloud where they can be searched, shared, downloaded, and reviewed later. The location of that data and who has access to it varies significantly between platforms.

Who Has Access to Meeting Recordings?

The most obvious audience includes the people who receive the meeting summary.

Many note taking platforms automatically distribute transcripts and summaries to all attendees. Some may even send information to invited participants who never actually joined the meeting.

For discussions involving confidential information, personnel matters, financial planning, or client data, that’s an important detail to understand.

There’s also the question of where the data is stored.

Third party note taking solutions often keep recordings and transcripts on their own cloud infrastructure. Depending on the vendor’s policies and administrative controls, access may extend beyond your organization.

Another overlooked risk is ownership. If an employee connects a personal or unmanaged note taking account to company meetings, recordings could end up stored in an environment your business doesn’t control.

Organizations that regularly discuss legal matters should be particularly cautious. In some circumstances, allowing outside services access to privileged communications may create additional legal considerations that should be reviewed with counsel.

Does the AI Use Your Meetings for Training?

This is one of the most important questions to ask before selecting any AI powered tool.

Microsoft states that Microsoft 365 Copilot does not use your organization’s prompts, responses, meeting recordings, or business data to train its foundation AI models. Meeting content remains within your Microsoft 365 environment and is governed by the same security, compliance, and access controls already applied to your tenant.

Third party solutions vary considerably.

Some vendors state they never train on customer data. Others may use customer information to improve services, depending on the licensing agreement and privacy terms accepted by the organization.

Two products that appear nearly identical on the surface may handle customer data very differently behind the scenes.

That is why reviewing privacy policies, security documentation, and data retention practices is critical before approving any AI note taking platform.

The Consent and Compliance Question

Recording a conversation isn’t always a decision one person can make alone.

Recording laws differ based on location and jurisdiction. Some states and countries require all participants to consent to recording, while others allow recording if at least one participant agrees.

Beyond recording laws, organizations must also consider privacy and data protection requirements.

In the United Kingdom and Europe, meeting recordings and transcripts are generally considered personal data under GDPR. Businesses must be able to explain why information is being collected, how it will be used, and who can access it.

The safest approach is transparency.

Participants should always know when a meeting is being recorded, understand the purpose behind the recording, and have an opportunity to raise concerns before recording begins.

This becomes especially important during:

• HR discussions
• Legal consultations
• Financial reviews
• Executive meetings
• Confidential client conversations

In some cases, obtaining legal guidance before recording may be appropriate.

Best Practices for Using AI Note Takers Safely

You don’t have to ban AI note takers to use them responsibly.

Instead, establish clear policies and governance around their use.

Choose an Approved Platform

Decide which note taking solution your company will use and communicate that standard to employees.

This helps ensure recordings are stored in approved locations under company control.

Disable Automatic Joining

Configure note takers to join meetings only when recording is intentionally enabled.

This prevents recordings from being created accidentally.

Always Announce Recording

Make it standard practice to notify attendees when a meeting is being recorded and explain why.

Transparency builds trust and helps meet privacy obligations.

Keep Data Within Your Environment

Whenever possible, select tools that store recordings and transcripts inside your organization’s Microsoft 365 or Google Workspace tenant instead of on third party systems.

Review Sharing Settings

Examine default permissions and distribution settings.

You may not want every transcript automatically emailed to all attendees or invited participants.

Exclude Sensitive Conversations

As a general rule, avoid recording:

• Legal discussions
• HR matters
• Confidential client meetings
• Merger or acquisition conversations
• Sensitive financial reviews

Unless there is a clear business need and all participants agree.

For organizations using Microsoft 365, administrators can manage transcription and Copilot related meeting settings centrally through Teams administration policies, creating consistency across the organization.

The Bottom Line

AI meeting note takers can be incredibly valuable tools. They save time, improve accountability, and help teams focus on conversations instead of documentation.

However, every recording creates a new set of security, privacy, and compliance considerations.

Before adopting any AI note taking solution, understand where the data is stored, who can access it, whether it is used to train AI models, and the legal requirements surrounding consent and retention.

When implemented thoughtfully, AI note takers can improve productivity without sacrificing security or privacy.

Frequently Asked Questions

Is it legal to record a meeting with an AI note taker?

Recording laws vary by location. Some jurisdictions require everyone involved to consent, while others only require consent from one participant. The safest approach is to notify everyone and obtain consent before recording.

Does Microsoft Copilot use meeting data to train AI models?

Microsoft states that prompts, responses, meeting content, and organizational data within Microsoft 365 Copilot are not used to train its foundation AI models.

Can an AI note taker join a meeting automatically?

Yes. Many platforms integrate with calendars and can automatically join scheduled meetings. Most tools allow administrators or users to disable auto join functionality.

Where are AI note taker recordings stored?

Storage depends on the platform. Microsoft 365 Copilot content remains within the Microsoft 365 environment, while many third party solutions store data on their own cloud infrastructure.

Should businesses allow tools like Otter or Fireflies?

Yes, provided there are clear policies in place. Organizations should approve specific platforms, review privacy terms, control sharing settings, require participant notification, and avoid recording highly sensitive conversations unless necessary.

Windows 10 Support Has Ended. What Should Your Business Do Now?

If your business is still running Windows 10, you’re not alone. Many organizations continue to use it every day because, on the surface, everything appears to be working fine.

The problem is that Microsoft’s support for Windows 10 ended on October 14, 2025. While your computers still power on, run applications, and access the internet, they are no longer receiving the regular security updates that protect against newly discovered threats.

That means the longer a Windows 10 system remains in service, the more vulnerable it becomes.

For most businesses, the options are straightforward: upgrade to Windows 11, purchase Extended Security Updates to buy additional time, or replace aging hardware altogether.

Before deciding which path makes sense, it’s important to understand what “end of support” actually means.

What Does End of Support Mean?

When Microsoft ends support for an operating system, it stops releasing updates for that product.

For Windows 10, that means:

• No new security patches
• No bug fixes or quality updates
• No feature enhancements
• No Microsoft technical support

Your computer doesn’t suddenly stop working. In fact, that’s part of the challenge. Everything seems normal, making it easy to delay action.

Behind the scenes, however, newly discovered vulnerabilities remain unpatched. Security researchers and cybercriminals continue finding flaws, but Microsoft is no longer fixing them.

Every newly discovered weakness becomes a permanent risk to any Windows 10 computer that remains online.

Why This Matters to Your Business

Running Windows 10 today isn’t simply a matter of using older technology. It can create real business risks.

Increased Security Exposure

Cybercriminals actively look for systems running unsupported software because they know vulnerabilities will remain open indefinitely.

Once a flaw becomes publicly known, attackers can develop tools to exploit it with little fear that the target system will be protected by a future update.

Unsupported operating systems often become low hanging fruit for ransomware groups and other threat actors.

Potential Compliance Issues

Organizations subject to regulations such as:

• HIPAA
• PCI DSS
• Financial or privacy regulations

are generally expected to use supported and regularly patched software.

Continuing to operate unsupported systems may create compliance concerns and increase exposure during audits or investigations.

Cyber Insurance Challenges

Many cyber insurance providers now evaluate an organization’s security posture before issuing or renewing coverage.

Running unsupported operating systems can potentially result in:

• Higher premiums
• Coverage limitations
• Additional policy requirements
• Increased scrutiny during claims reviews

Software Compatibility Problems

Over time, software vendors stop supporting older operating systems.

Browsers, accounting applications, security tools, and line of business software may eventually stop receiving updates or become incompatible with Windows 10 altogether.

The result is increased operational risk and reduced reliability across your environment.

Your Three Options

Most organizations end up using a combination of these approaches depending on the age and role of each device.

1. Upgrade to Windows 11

For devices that meet Microsoft’s hardware requirements, upgrading to Windows 11 is usually the most cost effective solution.

Many business computers purchased within the last several years are capable of making the transition without replacing hardware.

Windows 11 requires:

• A supported processor
• TPM 2.0
• Secure Boot support

Microsoft’s PC Health Check tool can determine whether a specific device qualifies.

For eligible systems, upgrading provides continued support and ongoing security updates while preserving users’ files and applications.

2. Purchase Extended Security Updates (ESU)

If a device cannot be upgraded immediately, Microsoft’s Extended Security Updates program can provide temporary protection.

ESU allows eligible Windows 10 devices to continue receiving critical security updates for a limited period after end of support.

This option is designed as a bridge, not a permanent solution.

It can be useful for:

• Legacy applications
• Specialized equipment
• Budget planning cycles
• Systems awaiting replacement

However, Extended Security Updates only provide security fixes. They do not include new features, major improvements, or full product support.

3. Replace the Device

For older hardware, replacement is often the smartest long term investment.

If a computer cannot meet Windows 11 requirements, continuing to maintain it may become increasingly expensive and risky.

A modern Windows 11 device typically provides:

• Better performance
• Improved security features
• Longer support lifespan
• Lower maintenance costs
• Enhanced reliability

When comparing replacement costs against ongoing support fees and productivity losses, purchasing new hardware is frequently the more economical choice.

How to Plan Your Transition

The good news is that you don’t need to replace everything overnight.

A structured approach can make the process manageable and cost effective.

Step 1: Identify All Windows 10 Devices

Create an inventory of every workstation, laptop, and specialty device still running Windows 10.

Many businesses are surprised to discover just how many systems remain.

Step 2: Determine Upgrade Eligibility

Evaluate which devices meet Windows 11 hardware requirements.

A simple assessment can quickly separate upgrade candidates from replacement candidates.

Step 3: Upgrade Eligible Systems

Devices that qualify should generally be upgraded first.

This reduces risk immediately while minimizing costs.

Step 4: Review Remaining Devices

For systems that cannot upgrade:

• Determine whether they are business critical
• Evaluate replacement costs
• Consider Extended Security Updates if additional time is needed

Step 5: Establish a Timeline

The worst approach is having no plan at all.

Even if upgrades and replacements occur gradually, establishing a roadmap ensures unsupported devices don’t remain in service indefinitely.

Frequently Asked Questions

Is Windows 10 still usable after support ended?

Yes. Windows 10 computers continue to function normally. However, they no longer receive regular security updates, making them increasingly vulnerable over time.

What happens if I do nothing?

Your systems will continue operating, but security risks will grow as new vulnerabilities are discovered and left unpatched. You may also face compliance, insurance, and software compatibility challenges.

Can my computer upgrade to Windows 11 for free?

If the hardware meets Microsoft’s requirements, the upgrade is generally available at no additional licensing cost. Microsoft’s PC Health Check tool can verify eligibility.

Are Extended Security Updates a long term solution?

No. ESU is intended to provide temporary breathing room while organizations complete migration plans. It should be viewed as a bridge, not a destination.

Should I replace older computers?

If a device cannot run Windows 11 or is nearing the end of its useful life, replacement is often the best long term solution from both a security and financial perspective.

Final Thoughts

Windows 10’s end of support doesn’t mean your computers stop working. It means Microsoft has stopped protecting them.

Every month that passes increases the likelihood that unsupported devices become an entry point for cybercriminals. Whether your organization chooses to upgrade, purchase Extended Security Updates, or replace aging hardware, having a plan is far better than waiting for a problem to force one.

For most businesses, the safest and most cost effective path is clear: identify your remaining Windows 10 systems and begin moving toward Windows 11 before those unsupported devices become a security liability.

When a cyberattack hits your business, the first hour can make all the difference.

It’s also the point where many companies unintentionally make things worse. Shutting down the wrong computer, deleting evidence, or communicating through an email account that’s already compromised can create bigger problems and make recovery more difficult.

The good news is you don’t need to be a cybersecurity expert to take the right first steps.

This guide walks through exactly what to do when you suspect a cyberattack, helping you protect your business while your IT team or security professionals take over.

Before Anything Else: Avoid These Common Mistakes

If you think you’ve been attacked, stop and take a breath before making any changes.

Avoid the following:

• Don’t power off the affected computer unless absolutely necessary. Disconnecting it from the network is usually the better option because shutting it down can remove valuable information investigators need to determine what happened.
• Don’t delete suspicious emails, ransomware notes, files, or alerts. Leave everything exactly as it is.
• Don’t rush to pay a ransom. Making a payment too quickly can complicate the recovery process and does not guarantee you’ll regain access to your data.
• Don’t use potentially compromised email accounts or systems to discuss the incident. If attackers have access to those accounts, they may be able to see those conversations. Use a phone call or another trusted communication method instead.

What to Do Step by Step

Work through these actions in order as soon as you notice something isn’t right.

1. Disconnect Affected Devices From the Network

Immediately isolate any devices that appear to be compromised.

• Unplug network cables.
• Disable WiFi connections.
• Disconnect affected systems from VPN connections if applicable.

The goal is to prevent the attack from spreading to additional computers, servers, or backups.

Cybersecurity experts generally recommend isolating systems rather than shutting them down whenever possible.

2. Contact Your IT Provider Immediately

Call your IT provider or cybersecurity partner right away.

A phone call is often safer than email during an active incident because you may not know whether email accounts have been compromised.

If your organization has cyber insurance, contact your carrier as soon as possible. Many policies require the insurer to be involved early in the incident response process.

3. Preserve the Evidence

Resist the urge to clean things up.

Do not:

• Reinstall operating systems
• Delete files
• Run cleanup utilities
• Restore from backup yet

Screenshots of suspicious messages, ransom notes, or unusual activity can be helpful, but always keep the original evidence intact for investigators.

4. Contact Your Bank if Money Was Sent

If you suspect fraudulent wire transfers, ACH payments, or other financial fraud, notify your bank immediately.

The sooner your bank is informed, the greater the chance they may be able to stop, reverse, or freeze the transaction before funds are moved elsewhere.

5. Reset Passwords and Enable Multi Factor Authentication

Using a device you know is clean and unaffected:

• Change passwords for email accounts first.
• Reset administrator account credentials.
• Change passwords for critical business systems.
• Enable Multi Factor Authentication (MFA) wherever available.

Email accounts are often the primary target because they can be used to access many other business systems.

6. Report the Incident

Reporting a cyberattack can help protect your business and may be required by law depending on the circumstances.

The appropriate reporting agency depends on your location.

Where to Report a Cyberattack

United States

Report the incident to:

• The FBI’s Internet Crime Complaint Center (IC3)
• The Cybersecurity and Infrastructure Security Agency (CISA)

United Kingdom

Report the incident to:

• National Cyber Security Centre (NCSC)
• Action Fraud

Australia

Report the incident through:

• ReportCyber
• The 24/7 Cyber Security Hotline at 1300 CYBER1

If money was transferred to scammers, report it immediately.

The FBI advises businesses to report wire fraud to IC3 as quickly as possible. Fast reporting gives investigators the best opportunity to help recover stolen funds.

If customer or employee information was exposed, additional reporting obligations may apply depending on your location and industry regulations.

Examples include:

• GDPR requirements in the United Kingdom and Europe
• State breach notification laws in the United States
• Australia’s Notifiable Data Breaches Scheme

Consult your legal counsel and IT provider as soon as possible to ensure you meet any required deadlines.

Should You Pay the Ransom?

When ransomware is involved, one of the first questions businesses ask is whether they should pay.

Law enforcement agencies, including the FBI, generally advise against paying a ransom.

Paying does not guarantee that:

• Your files will be restored
• Attackers will keep their promises
• Your data won’t be leaked later

It also demonstrates that your organization is willing to pay, which may increase the risk of future targeting.

Every situation is different. Decisions regarding ransom demands should be made in consultation with law enforcement, your incident response team, cybersecurity professionals, and your cyber insurance provider.

In some cases, free decryption tools already exist for specific ransomware variants, making professional guidance especially important before considering payment.

The Best Time to Prepare Is Before an Attack Happens

Responding to a cyberattack is significantly easier when you have a plan in place beforehand.

Most small businesses don’t need a complicated incident response manual. A simple one page plan is often enough.

At minimum, your plan should include:

• Emergency contact information for your IT provider and cyber insurance carrier
• A record of where backups are stored and confirmation they have been tested
• A list of critical systems, devices, and accounts that should be prioritized during an incident

Having these basics documented before an attack occurs can save valuable time and reduce stress when every minute matters.

Frequently Asked Questions

What’s the First Thing I Should Do During a Cyberattack?

Disconnect any affected device from the network by unplugging network cables and disabling WiFi. Then contact your IT provider immediately by phone. Isolating the device helps prevent the attack from spreading.

Should I Turn Off a Computer Infected With Ransomware?

If possible, disconnect it from the network instead of powering it off. Shutting down a system can remove valuable forensic evidence stored in memory. Power it off only if there is no other way to isolate it.

Should I Pay the Ransom?

Law enforcement generally advises against paying. There is no guarantee you will recover your data, and payment can encourage future attacks. Consult with cybersecurity professionals, legal counsel, law enforcement, and your insurance provider before making any decision.

We Sent Money to a Scammer. What Should We Do?

Contact your bank immediately and request that the transaction be recalled or frozen. Report the incident to the appropriate authorities as quickly as possible. Fast action offers the best chance of recovering funds.

Who Should I Report a Cyberattack To?

In the United States, report cyber incidents to IC3 and CISA. In the United Kingdom, report them to the NCSC and Action Fraud. In Australia, report them through ReportCyber. You should also notify your cyber insurance provider and determine whether any regulatory reporting requirements apply.

Most business owners assume that if an email appears to come from their company, it actually did.

Unfortunately, that’s not always true.

Without the proper protections in place, a cybercriminal can send an email that appears to come from your domain, add your logo, and request that a customer pay an invoice or update banking information. To the recipient, it can look completely legitimate.

This type of attack is called email spoofing, and it remains one of the most common ways businesses, customers, and vendors fall victim to fraud.

Fortunately, there are three technologies designed to prevent it: SPF, DKIM, and DMARC.

Many organizations have one or two configured correctly but leave the third incomplete or missing entirely. That small gap is often enough for fraudulent messages to get through.

In this article, we’ll explain what each of these protections does, why DMARC is frequently misconfigured, and how to determine whether your domain is properly protected.

Why Email Spoofing Is Still Possible

Email was created during a time when trust was assumed.

By default, the email system does not automatically verify that the person sending a message actually owns the address shown in the From field. In many ways, that field is similar to a return address written on an envelope. Anyone can write almost anything there.

Cybercriminals take advantage of this weakness.

They send messages using your company domain in the From address and, if your domain is not configured correctly, the receiving mail server may accept the message as legitimate. The result is an email landing in a customer’s inbox appearing to come directly from your business.

That is why cybersecurity organizations around the world, including the UK’s National Cyber Security Centre, strongly recommend anti spoofing protections.

The Three Records That Protect Your Domain

Three DNS records work together to verify that email sent from your domain is legitimate.

Once configured, receiving mail servers check these records every time an email is sent from your company.

SPF (Sender Policy Framework)

SPF identifies which mail servers are authorized to send email for your domain.

When a receiving mail server gets a message claiming to be from your organization, it compares the sending server against your published SPF record. If the server is not authorized, the message can be flagged or rejected.

Think of SPF as a guest list for your email system. If the sender is not on the list, it raises a red flag.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every outgoing email.

Your email platform signs each message with a private key, while a matching public key is published in your DNS records. Receiving servers use that public key to verify two things:

• The message genuinely came from your domain
• The content was not altered during delivery

DKIM helps establish both authenticity and integrity.

DMARC (Domain Based Message Authentication, Reporting and Conformance)

DMARC builds on SPF and DKIM.

It tells receiving mail servers what action to take when a message fails authentication checks. It also ensures that the visible From address matches the domain verified by SPF or DKIM.

This is what prevents someone from impersonating your exact business email address.

DMARC also generates reports that show who is sending email as your domain, including unauthorized senders that should not be there.

The DMARC Mistake We See Most Often

DMARC can be configured with three different policy settings:

p=none
Monitor only. The receiving server takes no action when messages fail authentication. Reports are collected, but spoofed email can still be delivered.

p=quarantine
Messages that fail authentication are typically directed to the recipient’s junk or spam folder.

p=reject
Messages that fail authentication are blocked entirely before they reach the recipient.

The most common mistake we encounter is organizations leaving DMARC set to p=none indefinitely.

While monitoring is an important first step, it does not provide protection. Your domain remains vulnerable to spoofing attacks until you move to quarantine or reject.

Microsoft and other major email providers recommend progressing toward p=reject once you have confirmed your legitimate email sources are configured properly.

What SPF, DKIM, and DMARC Cannot Stop

These technologies are extremely effective, but they are not a complete solution.

There are two common attack methods they do not fully address.

Lookalike Domains

A cybercriminal can register a domain that resembles yours.

For example:

• yourcompany.co instead of yourcompany.com
• yourcompanybilling.com
• yourcompanyinvoices.net

Because the attacker owns that domain, your SPF, DKIM, and DMARC records cannot stop them from sending email from it.

Display Name Spoofing

The sender name shown in an email can say something like:

“Your Company Accounting Department”

while the actual sender address is an unrelated Gmail account.

DMARC protects domains, not display names.

Because of this, employees should always verify the full sender address before responding to requests involving payments, banking changes, passwords, or sensitive information.

When in doubt, confirm requests using a known phone number rather than information provided in the email.

Why Every Business Should Care

Many organizations assume these protections only matter for companies sending large volumes of email.

That is not the case.

The primary reason to implement SPF, DKIM, and DMARC is to prevent criminals from impersonating your business.

These protections help safeguard:

• Customers
• Vendors
• Employees
• Business partners

There is also a deliverability benefit.

Major email providers increasingly expect domains to use proper authentication. Organizations that fail to implement these standards are more likely to see legitimate messages filtered as spam or rejected altogether.

Even if your company sends only a modest number of emails, proper authentication improves trust and inbox placement.

How to Check Your Domain

You can perform a basic assessment using one of the many free SPF, DKIM, and DMARC lookup tools available online.

These tools will tell you whether records exist and provide a general indication of how they are configured.

However, simply having the records in place does not guarantee they are correct.

Proper implementation typically requires access to your DNS settings and a clear understanding of every system that sends email on behalf of your organization.

A typical deployment follows these steps:

1. Configure SPF to include all legitimate email services.
2. Enable DKIM for your email platform.
3. Publish a DMARC policy of p=none and review incoming reports.
4. Resolve any authentication failures.
5. Move to p=quarantine.
6. Eventually move to p=reject once everything is validated.

This phased approach helps prevent legitimate business email from being blocked while improving domain security.

Frequently Asked Questions

What is email spoofing?

Email spoofing occurs when someone sends a message using your company’s domain in the From address to make it appear as though the email came from your organization. It is commonly used in invoice fraud, banking scams, and phishing attacks.

What do SPF, DKIM, and DMARC do?

SPF identifies which servers can send email on behalf of your domain. DKIM verifies that messages are authentic and have not been altered. DMARC ties those controls together and tells receiving servers how to handle messages that fail authentication.

Does DMARC stop all email impersonation?

No. DMARC protects your actual domain from being forged. It does not prevent criminals from using lookalike domains or display name spoofing.

Will DMARC block legitimate email?

Not when implemented correctly. Starting with a monitoring policy and gradually progressing to stricter enforcement allows you to identify and resolve issues before messages are blocked.

Do small businesses need SPF, DKIM, and DMARC?

Absolutely. These controls protect your reputation, your customers, and your employees regardless of company size. They also improve the likelihood that your legitimate emails reach the inbox instead of the spam folder.

Final Thoughts

Email remains one of the most commonly exploited business communication tools. SPF, DKIM, and DMARC are simple but powerful safeguards that make it significantly harder for criminals to impersonate your company.

If you’re unsure whether your domain is configured correctly, now is the time to check. A few DNS records can make the difference between a trusted email reaching the inbox and a cybercriminal successfully impersonating your business.

Passkeys: The Beginning of the End for Passwords

Passwords have been one of the biggest security weaknesses in business for decades.

Employees reuse them across multiple accounts, store them in unsecured locations, create weak combinations that are easy to guess, or unknowingly enter them into convincing phishing websites. Even with security awareness training and multi factor authentication, passwords remain one of the most common ways attackers gain access to business systems.

That’s why major technology companies are moving toward a different approach: passkeys.

A passkey allows employees to sign in using the same fingerprint, face scan, or device PIN they already use every day. There is no password to remember, type, reset, or accidentally give away.

In this article, we’ll explain what passkeys are, why they’re significantly more secure than traditional passwords, and why businesses should begin planning for a passwordless future.

What Is a Passkey?

A passkey replaces the traditional password with cryptographic credentials stored securely on your device.

Instead of entering a username and password, you verify your identity using:

• Your fingerprint
• Facial recognition
• A device PIN
• Another built in authentication method

When a passkey is created, your device generates two digital keys:

• A private key that remains securely stored on your device
• A public key that is stored by the website or application

When you sign in, the website sends a challenge to your device. Your device uses the private key to verify the challenge, and after you confirm your identity with your fingerprint, face scan, or PIN, you’re signed in.

At no point is a password transmitted or stored because there isn’t one.

Passkeys are built on FIDO standards that are supported by Microsoft, Apple, Google, and many of the world’s largest technology providers.

Why Passkeys Are More Secure Than Passwords

Traditional passwords rely on a shared secret. Both you and the website must know the same password.

That shared secret is exactly what attackers target.

Passkeys eliminate that weakness entirely.

They Can’t Be Phished

One of the biggest advantages of passkeys is their resistance to phishing attacks.

A passkey is tied to the exact website or application it was created for. If a user accidentally visits a fake login page designed to mimic Microsoft 365, Google, or another service, the passkey simply won’t work.

There is nothing for the user to type, copy, or unknowingly give away.

Since phishing remains one of the leading causes of account compromise, this alone dramatically improves security.

There Is No Password to Steal

When companies experience data breaches, attackers often target databases containing usernames and passwords.

With passkeys, websites store only a public key, which is useless on its own.

Even if an attacker breached the service, there are no password lists to steal and reuse against other accounts.

No More Password Reuse

Most people reuse passwords despite knowing they shouldn’t.

The challenge isn’t understanding the risk. It’s remembering dozens or hundreds of unique passwords.

Passkeys remove that burden entirely.

Each passkey is automatically created, unique to the service being used, and never reused elsewhere.

This eliminates one of the most common security mistakes made by employees and consumers alike.

Nothing to Forget

Password resets consume an enormous amount of IT time and frustrate employees.

Passkeys reduce this issue because there are no complex passwords to memorize, rotate, or reset.

Users simply authenticate with the device they’re already using.

Where Passkeys Are Already Being Used

Passkey adoption has accelerated quickly.

Today, passkeys are supported by:

• Microsoft accounts
• Microsoft 365
• Google accounts
• Apple accounts
• Many banking platforms
• Password managers
• Business applications
• Cloud services

Apple, Google, and Microsoft have built passkey support directly into their operating systems, browsers, and mobile devices, making adoption significantly easier than previous authentication technologies.

Synced Passkeys

Most users will encounter synced passkeys.

These passkeys are securely backed up and synchronized through your:

• Microsoft account
• Apple account
• Google account

If a device is lost or replaced, the passkey remains available across your other approved devices.

Device Bound Passkeys

Some organizations require an even higher level of security.

Device bound passkeys remain on a specific device and are not synchronized elsewhere. These are commonly used with hardware security keys and highly sensitive accounts where maximum security is required.

Should Your Business Start Using Passkeys?

For most organizations, the answer is yes.

The good news is that moving to passkeys doesn’t require an overnight transition.

In fact, the most successful deployments begin with a small group of users and gradually expand over time.

If your business uses Microsoft 365, passkeys are already supported through Microsoft Entra. Employees can authenticate using:

• Microsoft Authenticator
• Security keys
• Supported Windows devices
• Mobile devices that support passkeys

Google Workspace supports passkeys as well, making adoption possible for many organizations without purchasing additional software.

A Practical Rollout Strategy

A phased approach works best.

Start With High Risk Accounts

Begin with users that represent the greatest risk if compromised:

• Global administrators
• IT administrators
• Finance teams
• Payroll staff
• Executives
• Employees authorized to move money

These accounts provide the greatest security return from passkey adoption.

Allow Employees to Use Both Methods Initially

Rather than eliminating passwords immediately, allow staff to add passkeys as an alternative sign in method.

This gives users time to become comfortable with the technology while reducing disruption.

Create Backup Methods

Every employee should have a recovery option.

Examples include:

• A secondary registered device
• A hardware security key
• Additional approved authentication methods

Planning for lost devices before rollout prevents support issues later.

Things Businesses Should Consider

Passkeys offer major advantages, but they are not completely without challenges.

Account Recovery Still Matters

If someone loses the only device that contains their passkey and has no backup configured, regaining access can be more difficult.

Recovery planning should be part of every deployment.

Not Every Application Supports Passkeys Yet

While adoption is growing rapidly, some older software platforms still rely entirely on passwords.

Most businesses will operate a mix of password based and passkey enabled systems for the foreseeable future.

Shared Accounts Require Special Planning

Passkeys are designed for individual users.

Organizations that still rely on shared accounts, kiosks, or generic logins should review those workflows before moving to a fully passwordless environment.

Frequently Asked Questions

What is a passkey in simple terms?

A passkey lets you sign in using your fingerprint, face scan, or device PIN instead of a password. Your device proves your identity securely without transmitting a password.

Are passkeys safer than passwords?

Yes. Passkeys cannot be phished, there is no password to steal in a data breach, and users cannot accidentally reuse or create weak credentials.

What happens if I lose my phone or laptop?

If you’re using synced passkeys, they remain available through your Microsoft, Google, or Apple account on other approved devices. Having a backup device or recovery method is strongly recommended.

Does Microsoft 365 support passkeys?

Yes. Organizations using Microsoft Entra can enable passkeys for users through supported authentication methods such as Microsoft Authenticator, security keys, and compatible devices.

Do passkeys replace multi factor authentication?

In many cases, yes. A passkey combines something you have (your device) with something you know or are (your PIN, fingerprint, or facial recognition), providing multi factor authentication in a single step.

Final Thoughts

Passwords have served their purpose, but they’re increasingly becoming the weakest link in modern cybersecurity.

Passkeys provide a simpler experience for users while dramatically reducing the risks associated with phishing, credential theft, password reuse, and account takeover attacks.

Businesses don’t need to eliminate passwords overnight. However, organizations that begin implementing passkeys today will be better positioned for a future where traditional passwords become the exception rather than the standard.

For most companies, passkeys represent one of the easiest ways to improve both security and user experience at the same time.

QR codes have become part of everyday business.

We scan them to view restaurant menus, pay for parking, connect to guest WiFi, access shared documents, verify accounts, and complete payments. Most of the time, we don’t think twice about it.

Cybercriminals know that.

As organizations have become more comfortable scanning QR codes, attackers have started hiding malicious links inside them to bypass traditional email security controls. The tactic has become so common that it now has its own name: quishing.

The reason it works is surprisingly simple. A QR code is just an image. Most security tools are designed to inspect text, links, and attachments, not necessarily the destination hidden inside a square barcode image. When someone scans that code with their phone, they often leave the protections of their corporate device behind.

In this article, we’ll explain what quishing is, why it has become so effective, the scams businesses encounter most often, and the practical steps that help keep your team safe.

What Is a QR Code Scam?

A QR code scam is a phishing attack that uses a QR code instead of a traditional hyperlink.

Rather than placing a suspicious web address directly into an email, attackers encode the link into a QR code image. The recipient scans the code, their phone opens the website, and they are taken to a fraudulent page designed to steal credentials, payment information, or other sensitive data.

The destination is usually familiar:

• A fake Microsoft 365 login page
• A counterfeit payroll portal
• An imitation banking website
• A fraudulent payment page

The QR code itself is not the threat. It is simply the method used to get users to a malicious website while avoiding traditional security checks.

Why QR Code Attacks Are So Effective

There are two major reasons QR code scams continue to succeed.

The Malicious Link Is Hidden Inside an Image

Most email security platforms analyze message content, hyperlinks, and attachments for signs of malicious activity.

A QR code hides the destination URL inside an image, making it more difficult for traditional detection tools to inspect.

From a security perspective, this creates a blind spot. The message may appear harmless because there is no visible suspicious link for users or filters to review.

The Attack Often Moves You to Your Phone

When employees click a suspicious link on a company managed computer, several layers of protection are often working behind the scenes:

• Endpoint protection
• Web filtering
• DNS security
• Browser security controls
• Threat detection tools

When a QR code is scanned with a personal mobile device, many of those protections may not exist.

Without realizing it, users move from a protected environment to an unprotected one, where attackers have a much better chance of success.

QR Code Phishing Is Growing Fast

QR code phishing is no longer a niche attack method.

Cybercriminals increasingly rely on QR codes because employees have been trained to be cautious about clicking links but may not apply the same skepticism when scanning a code.

Attackers frequently embed QR codes inside:

• PDF attachments
• Invoice documents
• Account verification notices
• Shared file requests
• Security alerts

Because the QR code appears inside an otherwise legitimate looking document, many recipients assume it is safe and scan it without hesitation.

What QR Code Scams Typically Look Like

While the presentation varies, most quishing attacks fall into a few common categories.

Fake Security Notifications

An email appears to come from Microsoft, your IT provider, or an internal administrator.

The message claims you need to:

• Reconfigure multi factor authentication
• Verify your account
• Prevent mailbox suspension
• Review unusual login activity

The email instructs you to scan a QR code, which takes you to a fake sign in page designed to steal your credentials.

Shared Document Requests

An email claims a colleague, vendor, or customer shared a document with you.

Instead of providing a direct link, the message asks you to scan a QR code to access the file.

Once scanned, you’re prompted to sign in, providing attackers with your username and password.

Fraudulent Invoices

A PDF invoice contains a QR code labeled:

“Scan here for faster payment.”

The code directs you to an attacker controlled payment page or fraudulent banking destination.

Delivery and Package Scams

Text messages and emails often claim you missed a package delivery and need to scan a QR code to reschedule delivery or pay a small fee.

In reality, the code directs victims to a credential theft or payment fraud website.

Tampered QR Codes in Public Places

Not every QR code scam begins online.

Attackers sometimes place stickers over legitimate QR codes found on:

• Parking meters
• Restaurant tables
• Event signage
• Public kiosks
• Payment terminals

You believe you’re scanning a trusted code but are actually being redirected to a malicious website controlled by a cybercriminal.

How to Protect Your Business

Defending against quishing attacks largely comes down to awareness and verification.

Treat QR Codes Like Links

A QR code should be viewed with the same level of skepticism as any unexpected hyperlink.

If a QR code arrives in an unsolicited email, especially one requesting credentials, payment information, or account verification, proceed carefully.

Check the Destination Before Opening It

Most smartphones display the destination website before loading it.

Take a few seconds to review the address.

If the domain looks unusual, misspelled, shortened, or unrelated to the organization you expected, do not proceed.

Go Directly to the Website Instead

If you receive a message saying your Microsoft account requires attention, don’t scan the code.

Instead:

• Open your browser
• Type the website address yourself
• Use a saved bookmark
• Access the service through your organization’s portal

Going directly to the source removes the risk of being redirected to a fraudulent site.

Be Wary of Urgent Requests

Attackers often try to create panic.

Messages claiming your account will be disabled, your payment is overdue, or action is required within 24 hours are designed to push you into acting before thinking.

Urgency is one of the most reliable indicators of a phishing attempt.

Use Strong Multi Factor Authentication

Even if a password is compromised, strong multi factor authentication can significantly reduce the chances of successful account takeover.

Options such as:

• Passkeys
• Hardware security keys
• Number matching authentication

provide stronger protection against phishing based attacks.

Inspect Physical QR Codes

Before scanning a QR code in public, take a moment to determine whether it appears genuine.

Look for:

• Stickers placed over existing codes
• Signs of tampering
• Misaligned or poorly printed labels

If something looks unusual, don’t scan it.

Educate Your Team

Many employees have received phishing awareness training focused on suspicious links and attachments but have never been warned about QR code scams.

A short awareness campaign with real world examples can significantly reduce risk across the organization.

What To Do If Someone Already Scanned One

If an employee scanned a QR code and entered information into the resulting website, act quickly.

1. Change the affected password immediately.
2. Change any other accounts using the same password.
3. Verify multi factor authentication is enabled.
4. Notify your IT team or security provider.
5. Review account activity for suspicious logins.
6. Contact your bank immediately if payment or financial details were entered.

Fast action can dramatically reduce the impact of a successful phishing attempt.

Frequently Asked Questions

Are QR codes safe?

Most QR codes are perfectly legitimate. The greatest risk comes from codes delivered through unexpected emails, text messages, or altered physical signage.

What is quishing?

Quishing is a phishing attack that uses a QR code instead of a traditional hyperlink to direct users to a malicious website.

Can email security stop QR code scams?

Sometimes, but not always. While many security vendors are improving image analysis capabilities, QR code attacks are specifically designed to bypass traditional link inspection methods.

Why are QR codes more dangerous than normal links?

A QR code hides the destination address from view and often moves users to a personal device with fewer security controls, making detection and prevention more difficult.

What if I scanned a suspicious QR code but didn’t enter any information?

If you immediately closed the page and provided no credentials, payment information, or personal data, the risk is generally low. However, it’s still a good idea to notify your IT team so they can monitor for any related activity.

Final Thoughts

QR codes have become a trusted part of modern business, which is exactly why cybercriminals are exploiting them.

The technology itself isn’t dangerous, but blindly trusting every code can be.

By treating QR codes with the same caution you would give an unexpected link, verifying destinations before signing in, and training employees to recognize quishing attacks, businesses can significantly reduce the chances of becoming the next victim.