Archive for category: General

New Phishing Emails Now Evade Spam Filters

/in , , ,

How Attackers Turn Familiar Calendar Invites Into Security Threats

Written by Bill Seybolt, Senior Cloud Advisor, Cumulus Global

A new kind of cyber attack is reaching employee inboxes by hiding inside meeting invitations and notifications. Attackers turn routine calendar invites into phishing delivery tools that currently bypass email defenses. We’re seeing these invites arrive with phishing links disguised as new voicemails, document reviews, and informational videos.

Key Takeaways

  • ✓ Attackers route phishing links through real calendar invites to bypass email filters
  • ✓ Fake verification prompts build user trust before asking for account logins
  • ✓ Hidden guest lists and unfamiliar web addresses expose fraudulent invites
  • ✓ Regular security training and modern inbox defenses prevent account takeovers
The New Cyber Attack That Email Filters Trust

These notifications succeed because they’re authentic calendar invitations originating from valid Google Workspace or Gmail accounts.

Since the invite routes through Google Calendar’s infrastructure, email security tools view the traffic as authorized calendar activity. The interactive elements function normally, meaning that accepting an invite adds an event to your calendar, and clicking a meeting link opens Google Meet.

For example, this email poses as a Google Meet notification containing a new voicemail:

Calendar invite with embedded cyber attack

The invitation claims that a voice message is waiting for playback. The layout features functional Google Meet links alongside authentic calendar RSVP buttons. A telling warning sign appears under the attendee details, where the invite notes that the guest list is “too large to display.” However, this indicator is easy to overlook, and it is not uncommon for people in larger companies to receive invitations with legitimate large guest lists.

Think Twice Before You Click

Clicking the link redirects you to a convincing Cloudflare prompt asking to verify that you’re human.

Fake CloudFare Screen That familiar checkpoint lowers your guard, because team members associate security tests with legitimate cloud services.

After passing the verification challenge, the browser lands on a forged authentication portal that looks like this:

Fake Gmail Login Page

The page mirrors a standard Google login screen, prompting the user to submit account credentials to access the recording.

If employees don’t inspect the browser address bar, the deception succeeds.

The address displays an external domain rather than Google’s legitimate sign-in service, so submitting a username and password hands over full control of your Google Workspace account.

3 Steps to Guard Your Business

Although this method of cyber attack is tough to block, here are three steps you can take to lower your risk:

  1. Teach your team how to recognize these attacks. Share this post and show them what a legitimate web address and sign-in page look like.
  2. Subscribe to a Security Awareness Training service to keep your team updated on common and emerging cybersecurity risks.
  3. Upgrade your email threat protection to a platform that lets staff report suspicious invites directly from their inbox. The underlying system learns from reported attempts, helping it block similar campaigns before they spread.

How We Help Keep Your Workspace Secure

Protecting your organization against evasive threats requires a coordinated defense, especially when someone clicks a deceptive link by mistake.

If you’d like to evaluate your current defense or discuss how to protect your Google Workspace environment, book a brief, no-obligation, intro meeting with one of our Cloud Advisors. We’ll review your setup and help you decide on practical next steps for your team.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Bill Seybolt

Senior Cloud Advisor, Cumulus Global

Bill helps small and midsize organizations adopt practical cloud solutions that fit their priorities and budgets. He works directly with leaders and teams to evaluate workflows, identify goals, and map out clear rollout plans. Having helped over 200 organizations successfully adopt cloud solutions, he turns complex IT decisions into clear, measurable business gains.

Where Have All the Google Workspace Discounts Gone?

/in ,

Where to Find Savings in Google’s New Incentive Model

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

For years, price reductions on Google Workspace subscriptions were standard practice. Organizations regularly secured price breaks by adjusting seat counts or signing multi-year agreements.

Key Takeaways

  • ✓ Routine contract renewals no longer include standard Workspace discounts
  • ✓ Savings require upgrading subscriptions or adding Gemini Business or Enterprise licenses
  • ✓ Mid-term upgrades grant incentive pricing and reset renewal timelines

Organizations regularly secured price breaks by adjusting seat counts or signing multi-year agreements.

The days of standard pricing reductions are behind us.

Google has shifted strategy, and price reductions are no longer a standard part of contract renewals.

How Did We Get Here?

Over the past five years, Google introduced several core structural adjustments to its productivity platform. The transition from G Suite to Google Workspace brought updated tier structures and monthly flexible plan surcharges. More recently, Google embedded Gemini AI directly into core subscription tiers.

These structural updates caused recurring price increases across the board. Some of our clients saw overall software fees double or triple over a short span of time.

To address pushback and retain customers, Google authorized partners to offer pricing breaks. These price adjustments depended on multi-year terms or modest license growth.

Where Are We Now?

The platform transition is complete, and Google established a clear structure for Gemini AI across Google Workspace Business and Enterprise tiers. Google’s market and pricing position no longer focuses on customer retention. Google is focused on Gemini AI adoption and deeper use of Google Workspace and Google Cloud services within organizations.

Google transitioned to an incentive model rewarding AI and utilization growth.

Current Google Workspace Incentives

Currently, you can qualify for incentive savings through specific subscription adjustments:

  • Upgrading your Google Workspace subscription to a higher Business or Enterprise edition with a commitment term of one to three years
  • Adding Gemini Business or Gemini Enterprise services for some or all of your users

If you are planning to add Gemini AI or upgrade your subscription, Google allows mid-term contract changes that give you access and reset your renewal timeline.

Next Steps

Our Cloud Advisors are available to discuss your current subscription and licensing. Assessing your Google Workspace subscription also helps ensure you aren’t paying for unused features.

We’ll help you explore eligible incentives so you can keep your cloud software costs predictable. Connect with our Cloud Advisors today to evaluate your options.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

Why AI Agents Never “Go Rogue”

/in ,

The Operational Truth Behind Recent AI Headlines

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Chances are, you have seen headlines about AI tools “going rogue,” such as this recent story from the New York Times about AI software that probed government websites and attempted to access restricted files without human direction.

Although that specific attempt failed, other security incidents involved AI tools successfully accessing sensitive systems.

Media coverage portrays these events as AI taking unauthorized initiative Sensational headlines create a perception that AI agents are evolving and could become beyond our control. In reality, these mishaps don’t happen because an AI agent gained sentience or conscious awareness. While these AI agents execute actions without being prompted, the breakdown stems directly from missing boundary settings and wide system permissions.

Key Takeaways

  • ✓ AI Agents follow literal instructions without using human judgment
  • ✓ Undefined permission rules cause unexpected software behavior
  • ✓ Clear operational parameters keep automated tasks running securely

The Facts Behind the Headlines

Autonomous AI Agents Do Not Possess Intent

AI agents can’t go rogue because they don’t possess consciousness. Although models and agents detect language and behavioral patterns, AI models and agents lack human reasoning, judgement, morals, and ethics.

If an instruction leaves room for interpretation, the software will work to fulfill the instruction without regard to the morality, legality, or consequences of its actions. If you instruct an AI agent to “gather all information about a topic,” the agent lacks the judgement to know that it should not hack a secure government website in search of that information… unless you tell it so.

When an AI agent “goes rogue,” the technology is performing as configured. Damaging behaviors result from a failure to fully define the agent’s role and its limits.

A Failure to Establish Boundaries

During recent security incidents, creators neglected to provide AI agents with specific guidelines detailing which data sources and systems could be accessed. Just as importantly, they neglected to establish firm boundaries around unauthorized behaviors. For example, unwanted edits could be prevented with a clear directive specifying that the agent is not allowed to alter external websites or third-party databases.

Industry Regulation vs. Internal Responsibility

In the case reported by the New York Times, OpenAI did not detect the unauthorized activity of the AI agent, revealing a negligent lack of operational monitoring, management, and control. The AI Agent was not instructed to seek human intervention before taking potentially illegal or damaging actions. OpenAI lacked systems to monitor that AI agent’s activities and notify those responsible or halt the activities.

Government efforts to establish regulations may provide clarity, but these regulations cannot replace organizational accountability. If your team deploys autonomous AI agents without safeguards against illegal acts, harmful damage, or predictable errors, your organization assumes direct liability.

You can protect your operations by establishing administrative boundary rules:

  • Specify if your agent is allowed to use internal or external resources
  • Ensure users interacting with an AI Agents hold proper authorization and permissions
  • Establish clear conditions for if and when an AI agent can alter data
  • Require human approval before the AI agent accesses secure data or modifies any data
  • Define strict rules for AI interactions with other agents and software, categorizing actions into three levels: allowed, requiring human approval, and prohibited.

We Can Help You Set AI Guardrails

Adopting AI and automated tools should strengthen your team’s operations without introducing unmanaged risks and liabilities. Setting clear boundary rules and oversight routines ensures your technology serves your business safely.

If you want your AI services to be productive, secure, and affordable, our Cloud Advisors are here to help. You can schedule a brief intro call to discuss your goals and explore practical next steps.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

What Every SMB Needs in a Managed Cloud Partner

/in ,

Finding Cloud Support That Fits Your Business

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Moving your operations to the cloud was supposed to make things easier. You cleared out the noisy server closets and gave your team instant access to work from anywhere. Although cloud providers keep physical infrastructure running, daily cloud environments don’t manage themselves on autopilot.

Key Takeaways

  • ✓ Managing cloud systems in-house creates operational bottlenecks for growing SMBs
  • ✓ Unmonitored apps lead to license bloat, software overlap, and hidden costs
  • ✓ Flexible co-management provides expert IT support while keeping you in control
  • ✓ Right-sized cloud oversight protects your data without straining your budget

As small and midsize businesses (SMBs) grow, managing cloud systems in-house creates daily friction. Internal staff get stuck fixing minor user issues, tracking billing changes, and handling complex security settings.

Understanding your in-house IT struggles makes it easier to find a managed cloud service partner who fits your needs.

The Limits of In-House Cloud IT

Business leaders don’t set out to under-resource their technology. Cloud platforms evolve quickly, and maintaining daily settings takes more time than a small team usually has.

The Jack-of-All-Trades Trap

Most SMBs rely on a small internal team for all things technology. Balancing daily help desk tickets with cloud security and compliance gets overwhelming fast. When routine support absorbs all their time, administrative updates fall behind.

Software Overlap

Growing teams regularly adopt specialized cloud applications for different projects. Without administrative oversight, organizations end up paying for inactive user licenses, overlapping software features, and unmonitored tools. Monthly credit card statements quickly start to reflect these hidden charges.

Security as an Afterthought

Keeping cloud platforms secure requires continuous maintenance. Setting up email and file storage is only the initial step. Busy internal teams rarely have time to review external file access, adjust identity settings, or configure email threat protection before a security incident happens.

The Operational Impact of IT Overwhelm

When internal staff get stretched thin, valuable work hours disappear into troubleshooting standard technical issues. Unplanned software changes and emergency fixes make IT budgeting unpredictable.

At the same time, minor setting oversights in Google Workspace or Microsoft 365 leave data vulnerable to credential theft and phishing attacks. Right-sizing your cloud oversight lets your internal team focus on work that moves your organization forward.

What SMBs Should Look for in a Managed Cloud Services Partner

The right external partner works alongside your team to deliver security, reliability, and clear business value. When evaluating your IT support, look for these key qualities:

Flexible Co-Management

Traditional IT service providers often take an “all-or-nothing” approach. A modern partner offers flexible co-management instead. They handle complex tier-two support, administrative policies, and system updates while allowing your internal staff to maintain control of daily operations.

Cross-Platform Knowledge

Your organization relies on specific software platforms to keep daily operations moving. Whether you run Microsoft 365, Google Workspace, or a hybrid environment, your partner should understand how these systems connect and help you maximize the tools you already have before pushing new software purchases.

Layered Cloud Security

Security works best when integrated directly into daily administration. A strong partner includes practical safeguards as standard practice, including:

  • Automated cloud backup and disaster recovery for file storage and email accounts
  • Multi-Factor Authentication (MFA) policies and administrative identity safeguards
  • Active monitoring of file permissions and deliverability settings

Pragmatic Cost Alignment

Most traditional IT providers design their services for larger corporations. They often avoid SMBs or push them into costly, rigid plans. The right partner focuses on practical options built around your operational size and budget, so you get real value without extra overhead.

4 Questions to Audit Your Cloud Setup

  1. Can your team quickly recover lost Google Workspace or Microsoft 365 data if files get deleted?
  2. Do user access permissions update automatically once an employee leaves your organization?
  3. Are you regularly reviewing software statements to identify and remove unused user licenses?
  4. Do you have active monitoring in place to catch email threats and suspicious logins?

Give Your Team Room to Focus

Your cloud setup should simplify your daily operations. At Cumulus Global, we specialize in delivering productive, secure, and affordable Managed Cloud Services tailored specifically for SMBs, local governments, and K-12 schools. We co-manage your environment, keep your systems secure, and ensure your cloud solutions adapt as your needs evolve.

How We Deliver Reliable Cloud Oversight

  • Managed Cloud Service Plans: Scalable service options designed to support your team, secure your infrastructure, and respect your budget.
  • Security CPR® Framework: Layered cybersecurity policies, proactive monitoring, and data recovery built directly into your routine IT operations.

Ready to simplify your cloud service challenges and give your team reliable tech support? Schedule a chat with a Cumulus Global Cloud Advisor today to explore practical paths forward.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

Shield Your Data From Shadow IT

/in , , ,

Spot Unapproved Software To Protect Sensitive Files

Written by Bill Seybolt, Senior Cloud Advisor, Cumulus Global

If someone on your team has ever signed up for a free web app to convert a PDF or used a personal file-sharing account to send a large file, you have experienced Shadow IT.

Key Takeaways

  • ✓ Unapproved cloud tools create hidden security and data exposure risks
  • ✓ Staff members adopt workarounds to solve immediate operational roadblocks
  • ✓ Centralizing account access restores complete IT visibility
  • ✓ Practical cloud governance keeps data safe without slowing daily work

Shadow IT includes the use of software, web services, or digital tools for work without explicit approval. Without visibility, hidden security gaps develop quickly. Sensitive files sit on external platforms without basic safety controls, and primary account protections like Multi-Factor Authentication (MFA) get bypassed.

Shadow IT use happens in all types of organizations, from small businesses and local governments to K-12 school districts and non-profits. Employees rarely adopt these unapproved cloud services out of bad intent. They’re usually just trying to solve a problem or keep work moving. Unfortunately, their intentions don’t matter when it comes to security risks.

Closing these cloud security gaps does not mean you need to lock down every device or take measures that would inhibit innovation. Instead, you can take a more proactive approach that keeps your data safe and your team working smoothly.

3 Core Sources of Shadow IT

Managing Shadow IT begins with an understanding where risks live. For small and midsize organizations, cloud security risks usually cluster in three core areas.

1. Visibility Gaps

You can’t protect software you don’t know about. When staff members adopt web tools without IT oversight, those applications sit outside your standard monitoring setup. If a security incident happens on an unmanaged platform, your team might stay unaware until sensitive files get compromised.

2. Access Control Exposures

When employees create web accounts with personal email addresses or basic passwords, standard safeguards like MFA are often skipped. After an employee leaves your organization, standard offboarding processes miss those hidden accounts entirely.

3. Data Overexposure

Unmanaged cloud platforms often lack strong access controls, which means employees might upload sensitive data, such as customer records, student files, or financial reports, into consumer apps. These services often grant broad public sharing permissions by default or store information without encryption.

Why Employees Turn to Shadow IT

Employees commonly turn to unmanaged tools for a few reasons:

  • Need for speed: Tight project deadlines push people to find instant tools rather than navigating a traditional request process
  • Feature gaps: Approved software might miss specific features that staff members need for specialized daily tasks
  • Lack of awareness: Team members often do not realize that simple or free web tools carry real data security risks

Educating your team about cyber risks and giving them a simple software request process removes the friction that leads to workarounds.

Close the Gaps: A Practical 4-Step Strategy

Addressing unmanaged software requires a balanced approach that protects your data while keeping daily work moving. Rather than setting up strict rules that slow everyone down, you can use a four-step plan to manage these risks effectively.

Step 1: Discover and Audit Your Cloud Tools

Start by checking your current environment. Modern identity management tools let you track single sign-on activity, evaluate network traffic, and spot unapproved apps. Finding out why employees chose specific software helps you decide if those features should be added to your approved platforms.

Step 2: Centralize Access with Single Sign-On

Require standard corporate logins across all business tools. Using your Google Workspace or Microsoft 365 credentials ensures MFA guards every entry point. Automated onboarding and offboarding workflows can then handle account access whenever roles change.

Step 3: Set up Data Protection Policies

Review file-sharing settings across your existing cloud drives and collaboration tools. Ensure least-privilege access rules are active so users only access files necessary for their immediate work. Establish a straightforward software request process so employees can easily submit new tools for security and budget review before adoption.

Step 4: Educate Your Team and Offer Approved Alternatives

Technology controls are most effective when supported by a strong security culture. Provide regular, practical training that explains how unapproved apps put company data at risk. When employees understand the risks and have straightforward access to powerful, approved tools, the incentive to use unmanaged workarounds diminishes significantly.

A Quick Checklist for Cloud Governance

  • ✓ Audit user permissions across all shared drives and repositories
  • ✓ Require enterprise single sign-on and MFA for third-party tools
  • ✓ Automate account offboarding to prevent leftover access from inactive users
  • ✓ Create a simple software request process for staff members
  • ✓ Run routine security reviews to track changing software usage over time

Secure Your Cloud Environment With Cumulus Global

Cloud technology should make work easier, not create hidden security risks. At Cumulus Global, we help small and midsize businesses, local governments, and K-12 schools build secure, productive, and affordable cloud environments.

Through our Managed Cloud Services and Security CPR® framework, we co-manage your IT services, streamline access controls, and give you clear visibility over your software tools so you can eliminate security gaps without slowing down your team.

How We Help

  • Cloud, Security, and AI Assessments: We evaluate your cloud infrastructure to uncover hidden SaaS apps, permission gaps, and exposed data.
  • SaaSOps & Identity Governance: We centralize access management, automate onboarding/offboarding, and ensure consistent policy enforcement.
  • Security CPR® Managed Security: We set up layered protection, active monitoring, and quick response capabilities aligned with your operational needs.

If you are ready to close your security gaps and simplify your IT management, connect with our team of cloud advisors today to discuss practical, right-sized security solutions for your organization.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Bill Seybolt

Senior Cloud Advisor, Cumulus Global

Bill helps small and midsize organizations adopt practical cloud solutions that fit their priorities and budgets. He works directly with leaders and teams to evaluate workflows, identify goals, and map out clear rollout plans. Having helped over 200 organizations successfully adopt cloud solutions, he turns complex IT decisions into clear, measurable business gains.

9.5 Questions to Answer for a Secure AI Foundation

/in , , ,

How to Audit Your Tools and Build a Smart AI Strategy

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Officially or not, your team is likely using artificial intelligence (AI) in their day-to-day work. The big question is whether those tools will help or hurt your business. To be truly effective, AI services need to be productive, secure, and affordable. With the AI hype machine pushing tools as quick fixes while businesses grapple with costs, security often gets overlooked.

Building a secure AI foundation protects sensitive information and intellectual property (both yours and your clients’) while preventing the hidden risks of unapproved software. To help you evaluate your current setup, we broke down these 9.5 essential questions into three practical categories.

Key Takeaways

    • ✓Unsanctioned AI tools and personal logins create hidden data risks
    • ✓Setting strict access permissions keeps sensitive files out of public models
    • ✓Human oversight and clear request paths keep daily AI use safe and accountable
    • ✓Audit trails and emergency kill-switches protect your operations during vendor breaches

See: What Is in Use

1) Which AI tools and agents are in use across the business, including those adopted without approval?

Unsanctioned tools hide data movement beyond your control. Adding extra tools can also duplicate capabilities you already have, leading to redundant services and higher costs.

2) Are employees accessing these tools through corporate accounts or personal credentials?

Personal logins mean you have no record of activity or ability to revoke access if someone leaves. You also lose the ability to manage information sharing and everyday workflows.

3) What company information has already been entered into AI tools, and by whom?

Pasting client records, IP, or financial data into public models can trigger immediate compliance violations under HIPAA, PCI, or state privacy laws. You may also violate industry regulations, contractual commitments, and non-disclosure agreements.

Secure: Where the Exposure Lies

4) What systems and records can each tool access, and is that access limited to what the role requires?

Managing individual and team access to information is no longer optional. With AI agents learning from your data, obscurity does not protect sensitive information from being discovered. Tools without proper permissions invite unnecessary exposure, breaches, and data leaks.

5) Have any integrations or connections been added since each tool was approved?

Checking access at implementation will not protect your organization long-term. As AI tools get used, permissions often expand automatically to enable new agents, workflows, and autonomous tasks. Managing AI security requires monitoring these permission changes over time.

6) Do employees know which categories of information should almost never be shared with an AI tool?

Not all information needs heavy locks, but sensitive data should almost never enter public AI systems. Most information falls somewhere in between. Setting clear permissions and data categories protects your organization before data ever leaves your system.

Steer: Who is Accountable

7) Which AI-generated work may be acted upon without human review?

Whether drafting documents or executing autonomous tasks, strict guardrails for human review will prevent costly and embarrassing errors.

8) What is the process when an employee requests a tool that is not yet approved?

A clear request path encourages safe innovation instead of hidden workarounds.

9) Could you demonstrate to a regulator, client, or insurer which AI tools have processed their data?

Having a clear audit trail is critical for maintaining client trust and meeting compliance standards.

Bonus Question

9.5) If a tool or its vendor were compromised, how quickly can you revoke access?

Almost no security setup is completely perfect, which is why having an immediate kill-switch is so important when an AI tool suffers a breach or malfunction.

We Can Help

With security and readiness assessments, and tools and services to monitor and manage security, our team can help you understand your current AI security posture, plan your environment, and deploy productive, secure, and affordable solutions.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

How Small Businesses and Schools Can Protect Sensitive Data While Adopting AI

/in , , ,

How Small Businesses and Schools Can Protect Sensitive Data While Adopting AI

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Artificial Intelligence (AI) is undeniably reshaping how daily work gets done. When used properly, AI tools can help your team draft proposals, analyze spreadsheets, and summarize complex research in seconds.

In fact, nearly 90% of small businesses, local governments, and schools are actively experimenting with modern AI tools. However, many teams are adopting these helpful tools much faster than they are setting up basic rules and security safeguards.

Key Takeaways

    • ✓Adopting AI without governance creates hidden internal security risks.
    • ✓Over 70% of organizations experience data leaks through unauthorized employee prompts.
    • ✓Protecting your data requires a simple, three-part strategy: See, Secure, and Steer.
    • ✓Proper access controls, tool vetting, and activity logging ensure safe, compliant AI usage.

Understanding the Risks

When employees use random online AI tools without guidance, sensitive information can easily leave your organization. Recent research from IT security firm SentinelOne shows that 70% of organizations have experienced internal data leaks through employee prompts. Further, more than 20% of surveyed organizations reported security breaches stemming from authorized or unauthorized AI use.

To protect your organization, your technology must be more than just convenient. These services need to be productive, secure, and affordable.

In previous posts, we discussed how focusing on specific use cases and leveraging built-in features in tools you already own will keep costs down while boosting productivity. Protecting that work requires a simple strategy built on three pillars.

The Three Pillars of AI Security

  See: Bring AI Usage Into Sharp Focus

Most organizations recognize the dangers of Shadow IT (the practice of employees adopting personal or unapproved apps without IT oversight). Shadow AI is the fast-emerging extension of that risk. When team members use personal AI accounts for work tasks, they open your business up to unseen exposure. To manage that risk, you need full visibility into what tools are in play and how your data moves through them.

A strong visibility strategy focuses on a few key practices:

    • Identifying which AI tools your team employs for daily tasks
    • Ensuring that everyone logs in using secure business credentials instead of personal accounts
    • Teaching your team what sensitive business and customer information should never be shared with AI systems

If you do not know what information your team has already shared with AI models, you likely have a hidden risk that needs attention.

 

  Secure: Lock Down Access and Safeguard Data

Before you connect AI models to your company files, your underlying permissions must be tight. AI tools can quickly read and organize whatever data they can access, which means a user might accidentally see restricted files through an AI search prompt.

Securing your data requires a proactive approach to access control:

    • Review user access permissions across all shared folders and cloud drives
    • Understand exactly what information your AI systems can reach
    • Monitor third-party integrations as software updates occur over time

 Steer: Navigate Governance and Chart Your Course

Secure AI lives within clear guardrails. Beyond locking down permissions, you need straightforward policies that guide your team as they use AI.

Setting proper controls involves:

    • Creating a simple process for employees to request new software tools
    • Establishing clear boundaries between automated tasks and work that requires human review
    • Logging system activity so you have clear records if something goes wrong

These guidelines give your team the confidence to use new tools safely while keeping your organization protected.

We Can Help

Through security and readiness assessments, as well as monitoring and management tools, our team can help you understand your current AI security posture, plan your environment, and deploy productive, secure, and affordable solutions.

Contact us or schedule time to connect with a Cloud Advisor to discuss your needs, priorities, and next steps.

Ready to Take the Next Step?

Whether you’re beginning your cloud migration or looking to improve an existing environment, our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

Secure Gemini AI in Google Workspace

/in , , ,

Three Ways to Protect Company Files When Your Team Uses Gemini AI

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Artificial intelligence offers incredible potential for productivity. AI also creates new security challenges.

Follow these three steps to protect and secure information when using Gemini AI in Google Workspace.

Key Takeaways

    • ✓Gemini AI sees what your Workspace settings allow
    • ✓Cleaning up shared files prevents sensitive data leaks
    • ✓Automated onboarding and offboarding keeps permissions accurate
    • ✓Decommissioning inactive accounts closes security gaps and cuts costs

Leaking sensitive, proprietary, or confidential data via AI is easy. An employee may put confidential financial data into a public AI tool, a private AI model, like Gemini AI, might read files that were overshared within your organization, or you may accidentally externally share sensitive information embedded in an internal model.

Gemini AI relies on your existing Google Workspace permissions. If a document is shared too broadly, the AI engine will make that information visible to unauthorized users.

Fortunately, you can secure your sensitive files and establish clear guardrails with a few strategic updates.

Step 1 of 3

Audit Your File Sharing Settings

Unintended file sharing happens quietly in nearly all organizations. Over time, link sharing and external permissions create hidden security risks.

Pay close attention to these common sharing pitfalls that can inadvertently surface confidential data to AI tools:

    • Exposure via Links: “Anyone with the link” settings can expose internal documents to external search engines and public AI crawlers.
    • Sharing to your Domain: Giving permission to your entire domain gives everybody, and every attached service, access to the information.
    • Lingering Access: External sharing permissions granted to contractors often remain active long after their work is complete.
    • Group Over-Sharing: Public Google Groups may inadvertently grant broad access to internal shared drives.

Use an automated tool to scan file, folder, and shared drive permissions against defined policies and compliance guidelines. Put systems in place to monitor and mitigate risks in real-time.

Step 2 of 3

Streamline User Onboarding and Offboarding

Manual IT administration is prone to human error and inefficiency. When employees join or leave, updating access controls requires careful detail.

Establishing automated lifecycle policies helps maintain strict access boundaries at every stage of employment.

    • Automate Onboarding: Add new hires to the correct Google Groups, shared folders, and chat spaces using policy-based automation.
    • Secure Transfers: Transfer file ownership directly to managers or secure shared drives as part of your offboarding workflow.
    • Cleanup Calendars: Remove former staff from internal meetings without disrupting active client appointments.
    • Manage Contacts: Ensure mobile address books remain accurate by clearing out former employees and transferring key business contacts.

Automate these steps to ensure your access controls are up-to-date and Gemini AI only displays sensitive files to authorized team members.

Step 3 of 3

Manage Inactive Accounts and Licenses

Inactive accounts waste budget and create unnecessary entry points for bad actors. Staff members who left months ago should not remain in your user directory.

Put automated management rules in place to ensure that former accounts are properly monitored and decommissioned:

    • Suspension Rules: Establish automated account suspension policies to keep your user directory secure and up-to-date.
    • Inactivity Alerts: Utilize alerts to track and address accounts with no login activity over a 30-day period.
    • License Management: Minimize software expenses and satisfy legal data retention requirements by transitioning offboarded employees to archive licenses.
    • Data Preservation: Safely eliminate paid licenses by transferring essential data into alternate cloud storage options.

Manage user lifecycles to reduce your monthly costs while protecting your company data.

Take the Next Step for Workspace Security

Securing your workspace does not require a complete operational overhaul. Targeted, automated changes create a foundation for strong data governance and reduce operational overhead and risks.

As demonstrated in our recent 3T@3 Series session, automated solutions like Patronum give you the capability to actively monitor and manage permissions and access, streamline your onboarding and offboarding processes, and secure your Google Workspace environment.

Contact us or schedule time to connect with a Cloud Advisor at Cumulus Global to arrange your workspace security review and to explore your options.

Ready to Take the Next Step?

Whether you’re beginning your cloud migration or looking to improve an existing environment, our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

Your Path to Full Cloud Adoption

/in ,

As a small or midsize business, you already use the cloud for daily work.

You likely run Google Workspace or Microsoft 365 for your email and calendars, and there’s a good chance you are storing and sharing files.

In short, your team is already familiar with cloud tools. However, do you still keep a physical file server in the office? This hybrid setup often creates technical hurdles for your remote and hybrid workers.

Here are three steps you can take to smoothly finish your cloud journey.

1) Upgrade to Cloud File Services

Move your files completely to the cloud. Doing so removes physical hardware headaches.

When you shift your data into shared environments like SharePoint or Google Shared Drives, your team still sees their files in a familiar layout. On the desktop, the cloud files look like a traditional network drive.

When you move to cloud services, you can expect to:

  1. Eliminate the cost of maintaining old office hardware
  2. Empower your team to work securely from any location
  3. Enable productivity with advanced file locking and approval workflows

Central control gives you the power to manage access, permissions, groups, and folders.

2) Migrate Your Business Applications Connect with a Cloud Advisor

Do you rely on local software for accounting, inventory tracking, or other line-of-business functions? If a web-based version exists that has the features you need, switching is a great choice. If not, a virtual desktop infrastructure (VDI) solves your problem.

With VDI services, your software runs inside a secure cloud environment. Your local computer simply displays the screen and receives your keystrokes.

VDI services:

  • Provide your team with a consistent user experience, whether in the office or working remotely
  • Improve security, as your software runs inside a hardened perimeter
  • Lower costs and give you the ability to scale resources up or down as needed
  • Replace large capital expenditures with predictable operating costs

While some systems, such as manufacturing automation, diagnostic lab equipment, and medical tools, need to run locally, the vast majority of business applications thrive in VDI environments.

3) Secure and Manage Your Cloud Environment 

Many leaders think that cloud providers handle every aspect of data safety. In reality, cloud providers operate on a shared responsibility model. They keep the core system running and protected, but you are solely responsible for securing your data. You control access. You control permissions.

Your data protection plan should include a few regular practices:

  • Creating independent backups of all cloud files to prevent data loss
  • Monitoring sharing permissions to ensure that sensitive data stays private
  • Setting up data loss prevention rules to block unauthorized sharing

We recommend using Managed Cloud Services to handle these ongoing security tasks. This proactive approach aligns with our Security CPR® framework to help keep you safe.

You would not leave a physical office server unmanaged. Your cloud environment requires the same consistent care and oversight.

Your Next Steps

Finishing your cloud journey does not need to happen all at once. We will help you analyze your current systems and your needs. We will design a practical path forward to ensure a productive, secure, and affordable cloud solution.

When you are ready to simplify, secure, and save, contact us or schedule a time to chat with a Cloud Advisor to discuss your options.

 

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America.

How We Use AI for Data Enrichment

/in , , ,

If you receive our newsletter or follow our blog, you’ve likely seen our recent posts and resources regarding proper AI usage. Our use of AI needs to be more than compliant with laws, regulations, and contractual obligations. We must be responsible and accountable for ensuring that our use of AI is both ethical and respectful to the individuals and organizations with whom we interact.

Our Commitment Includes Transparency and Security

At Cumulus Global, our commitment to ethical and appropriate use of AI includes transparency in why, when, and how we use AI services.

Any data we process through these AI tools is protected under our strict internal security protocols, ensuring your information remains secure, confidential, and never sold to outside parties.

Where We Use AI for Data Enrichment

As with most businesses, accurate information about clients, vendors, and partners is essential for managing services and communications. Data enrichment is a vital part of this process.

By definition, data enrichment is the process of updating information by filling in missing data or collecting new, relevant details.

We are currently piloting AI-powered tools to help us enrich the data we store about individuals and organizations. Doing so will give us better context for managing client relationships and for focusing our marketing and sales communications to those most likely to be interested.

Cumulus Global runs much of our operations using HubSpot, including our marketing, sales, and service functions. HubSpot features several tools (some of which use AI) to verify and update data elements in contact and company records.

Connect with a Cloud AdvisorHubSpot Breeze AI

Breeze AI is a service within HubSpot that offers data enrichment services by using the HubSpot Commercial Dataset to fill in missing fields.

Similar to commercial products like ZoomInfo, Cleanlist, Apollo, the HubSpot Commercial Dataset gathers publicly available information directly from individuals, as well as from third parties where a legal basis exists to process the information. However, unlike these other services, we cannot use HubSpot to identify new potential customers. We can only use the service to fill in missing information within our existing customer or company contact records.

Much of what the service provides involves common missing information, such as countries for addresses, country prefixes for phone numbers, and job titles. The AI component analyzes this information alongside the data we already have to provide further context, such as job function and authority. For example, a record may be updated to reflect a contact’s role as a senior manager in an operations department. The AI service also cross-references opt-outs and other verifications to help ensure we do not send you unwanted messages.

LinkedIn Integration

When a person or an organization is added to our database, HubSpot will, if possible, match the information to the person’s public LinkedIn profile or a company’s public page. HubSpot scans these public profiles and pages to fill in basic information, such as job titles, website domains, and employee counts.

You Are in Control

You are always able to manage how much of your information is shared.

LinkedIn

LinkedIn has several settings that allow you to extensively limit what the platform shares. You can review and manage these settings through your LinkedIn account.

HubSpot Commercial Dataset

HubSpot, like ZoomInfo and other data aggregators, provides the ability on its website to delete your data from the HubSpot Commercial Dataset. Doing so serves as an opt-out of the “sale” of data under relevant laws. Cumulus Global is immediately notified, and any data used to enrich our records is removed.

Cumulus Global

We do not share information other than as needed to provide our services to you and your company. You can manage which types of communications you receive from us by using the “Manage Preferences” link at the bottom of all of our automated emails.

We Are Here to Help

If at any time, you have questions or concerns, please send us an email or use the chat box or contact form on our website.

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America.