On Friday, November 13, WTMJ in Milwaukee brought me on as their security expert to talk about the Microsoft outage. The question from the anchors was simple. Microsoft says this was not a breach. So how worried should we be about the next one?
Here is the short version of what I told them, and what I would tell any business owner in Fort Worth this week.
What happened
Microsoft 365 started failing on Thursday, November 12. Outlook, Teams, OneDrive, and Copilot went down for users in every region. Recovery dragged into Friday, and the outage ran past 20 hours before email queues approached normal.
Microsoft says it found no sign of malicious activity. Its Friday statement traced the problem to an issue from an earlier network capacity upgrade that surfaced after a more recent network change. In plain terms, it was a self-inflicted wound. Microsoft has promised a full post-incident report.
No attacker needed. One company changed its own network, and millions of people lost email for most of two business days.
Treat it like a drill
You did not choose to run this exercise, but you got the results anyway. Use them.
Sit down with your team and answer three questions while the details are fresh:
What could you not do for those 20 hours? Email, scheduling, payroll, customer files, shared drives.
Who noticed first, and how did they find out it was not a problem on your end?
What did you do instead, and would it hold up for three days instead of one?
Then fix what broke. Most businesses will find the same answer. They run everything through one network, one vendor, one login. That is a choke point. It is a vulnerability whether the cause is a bad upgrade or a hostile actor.
Everything connected carries a vulnerability
I told WTMJ I was not tying the Microsoft outage to an attack, and I am not here either. But it lands in the same month as a string of real attacks on equipment most people never think about.
In October, hackers took over refrigeration controllers at hundreds of supermarkets in France. On November 2, a second wave hit chains in seven more European countries. The Pentagon is investigating whether freezer failures at commissaries on at least six U.S. military bases in August were a cyberattack. That case is not confirmed. On November 5, CISA, the FBI, and three other federal agencies issued a joint warning about attacks on industrial refrigeration and cold chain systems. Their first recommendation: get those controllers off the public internet. We broke those attacks down earlier this week in Cold-Chain Cyberattacks.
A freezer is a small thing. It shows the pattern. Every device we connect for convenience opens a door for someone else. Convenience and security fight each other. The more you have of one, the less you usually have of the other. Your job is to choose where you land on that line on purpose.
The attacker only has to be right once
The anchors asked how active foreign adversaries are in this space. It is an everyday operation. Nation-states look for a way in every day, whether to attack now or to plant a back door they can use later. Our side does the same work on defense and offense.
What changed is the barrier to entry. Advanced AI tools have cut the experience and training a would-be hacker needs. That shifts the math against defenders.
An attacker only has to be right once. A defender has to be right every time.
Audit the people, not just the systems
Government runs on private vendors, from networks to logistics. That is not new, and it works. But the systems that touch critical infrastructure need more top-down oversight: more audits, more safeguards, and more checks on the people who hold access, not just the software.
The same rule scales down to a small business. Know which vendors and which employees can reach your most important systems. Review that list on a schedule.
What to do this week
Write down the three systems your business cannot run without, and the one vendor each depends on.
Set up a backup channel for urgent client and staff contact that does not ride on the same platform.
Find every connected device on your site: cameras, door controllers, thermostats, alarm panels. Change default passwords and confirm each one sits behind a firewall, not on the open internet.
Install updates when they arrive. Those phone patches every few months exist to close holes someone already found.
List who holds admin access to each system, and remove anyone who no longer needs it.
The physical layer still matters
When the cameras, badge readers, and cloud dashboards go dark, a trained officer on post still sees the door. Our licensed security officers give Fort Worth and DFW businesses a layer that does not depend on a server staying up.
Thirteen Alpha Solutions LLC · TX DPS Class C License #C31017501 · 4364 Western Center Blvd #2105, Fort Worth, TX 76137 · SDVOSB certified · TALI member · Insured and bonded
