Antivirus is not enough: what managed EDR does
Antivirus looks for files it already knows are bad. EDR watches what programs do, isolates a device when something looks wrong, and pages a person.
17 min readRead more
All insights.
Ideas and practical guidance from the work we do.
What you can find in ALCO’s newsletters
ALCO now publishes separate email editions for Industry News, Tech Tips and Company News. Choose the topics you want at signup.
13 min readRead more
A year-end reading list from ALCO
ALCO’s year-end reading list collects practical guidance for the systems small teams depend on.
17 min readRead more
Check one shared folder for stale access
Review direct access, groups, and sharing links in a single pass.
10 min readRead more
Run a first-day IT check before a new hire starts
Use one real work task to check accounts, devices, and access before the first morning.
15 min readRead more
Google rolls out a Chrome desktop security update
The November 9 Stable release includes nine security fixes and is rolling out in stages.
12 min readRead more
Make a renewal list you can hand off
Put the owner and renewal status of your website domain, certificates and hosting in one place.
15 min readRead more
Microsoft revises the SMTP AUTH timeline
Microsoft’s revised Exchange Online timeline keeps Basic authentication behavior unchanged through December 2026.
14 min readRead more
Google adds Gemini response analysis to Forms
Google’s November 5 announcement describes a phased rollout for eligible accounts.
14 min readRead more
Google Drive tests policy-based encryption
Google announced a beta for policy-based client-side encryption in Docs, Sheets, Slides and Drive.
14 min readRead more
Google Forms adds Gemini response insights
Google announced Gemini response analysis for Forms in November. The feature can surface themes and suggest next steps.
13 min readRead more
Google Meet adds a pre-call policy notice
Google announced that Workspace admins can show policy text before users join a Meet call.
12 min readRead more
Google Vids adds longer generated clips
Google announced clips up to 15 seconds through Gemini Omni 1.2 Flash on November 5.
14 min readRead more
Google Workspace tests policy-based encryption for Drive files
Google announced a beta on November 5 that lets admins apply encryption through rules.
16 min readRead more
Write a holiday coverage handoff
Give whoever is covering a short list of systems, owners and first steps they can use without calling you.
13 min readRead more
Microsoft ships November Windows security updates
Microsoft’s November 10 release is out. Here’s what a small team can check after patching.
17 min readRead more
Run a one-hour year-end IT review
Spend the hour on three pieces of evidence you can carry into January: a successful restore, a supported-device inventory and a named owner for each open item.
13 min readRead more
Passkeys put account recovery in the spotlight
What passwordless sign-in changes for small teams, and what to check before rolling it out.
14 min readRead more
Remove stale access from one workspace
Pick one shared workspace and review who can get in, which links still work and who owns the next review.
13 min readRead more
Practice resetting a locked-out account
A practice recovery can reveal whether your backup sign-in method works when the primary one is unavailable.
13 min readRead more
Test your backup with a fresh account
A restore can succeed while the person who needs the file still cannot open it. Test both steps in a temporary folder.
15 min readRead more
Set up a guest Wi-Fi network and test it
Give visitors a separate connection and check that it stays separate.
15 min readRead more
Give each security risk an owner
What small businesses can take from NIST’s cybersecurity guidance without starting with a long checklist.
12 min readRead more
Cloud sync and backup solve different problems
Why a separate recovery copy matters when files are deleted, encrypted, or overwritten.
13 min readRead more
Test your backup by restoring one file
A short recovery exercise that checks whether you can get back the version you actually need.
12 min readRead more
Check who owns your shared inbox
Find out whether a second person can answer a routine request while the usual inbox owner is away.
13 min readRead more
Test your contact form like a customer
Follow one inquiry from a phone to the right inbox and check who owns the reply.
12 min readRead more
Verify a payment change before approving it
Use a contact method you already trust and keep a record of the check.
14 min readRead more
Windows 11 23H2 Enterprise and Education reach end of updates
November 10 was the final monthly security update for these two Windows 11 editions on 23H2.
16 min readRead more
Windows 11 24H2 support differs by edition
Microsoft ended updates for Windows 11 24H2 Home and Pro in October 2026. The Enterprise and Education timelines differ.
15 min readRead more
Windows release changes to carry into 2027
Microsoft’s Windows lifecycle tables show which editions and versions are still supported and when their update windows end.
14 min readRead more
Windows updates follow a monthly cadence
Microsoft publishes Windows security updates on the second Tuesday of each month. Its release history is the source to check for the latest build.
13 min readRead more
Google adds timed pauses to Workspace Studio
Google announced a Wait until step on November 9. It lets a flow pause and resume later, including inside a branch or loop.
15 min readRead more
What device management does, in plain English
Every laptop and phone that touches company data should be set up the same way, locked down the same way, and wipeable in minutes. That is device management.
20 min readRead more
Your website after launch: what care actually means
A website is not finished when it goes live. Updates, backups, uptime checks and the small changes nobody wants to learn WordPress for. What care involves.
19 min readRead more
What managed hosting actually includes
Managed means something different on every price list. What it should cover, what it should not, and five questions that reveal which kind you are buying.
19 min readRead more
Inside the ALCO server
Every site ALCO hosts runs on one server-class machine we own and watch. What is in the box, how clients are kept apart, and what happens when a part fails.
16 min readRead more
What Cloudflare does for a small business website
Every site ALCO hosts sits behind Cloudflare Enterprise. Here is what that shield actually does, in plain words, and what it does not do.
18 min readRead more
Why ALCO's website is now available on Tor
ALCO's public website now has a Tor address alongside the regular one. What it offers, what it does not promise, and how to open it safely.
14 min readRead more
Backups you have actually seen restored
A green light on a backup job is not a recovery. What a real backup setup looks like for a small business, and the question that separates a plan from a hope.
18 min readRead more
DNS in plain English: the records behind your domain
Every website visit and every email starts with a DNS lookup. The five record types that matter, what each does, and the mistakes that take businesses offline.
18 min readRead more
Two-step sign-in without the pain
Done the hard way, two-step sign-in means lockouts and lost phones. Done right, it costs a few seconds a week and stops the most common break-in cold.
19 min readRead more
Email that lands: SPF, DKIM and DMARC explained
Three records in your domain decide whether your mail reaches the inbox and whether a stranger can send as you. What each one does, and how to check yours.
19 min readRead more
Notice of hosting downtime: critical PHP security updates tonight at 6:00 PM MT
ALCO is enforcing critical PHP2Shell security updates on every site and application we host, starting at 6:00 PM Mountain Time on October 21, 2026. Hosted sites and ALCO systems may be briefly unavailable.
14 min readRead more
Google Workspace or Microsoft 365: how to pick
Both are good. Both are secure when set up well. Stop comparing feature lists and ask four questions about how your business actually works.
20 min readRead more
Three questions every business owner should be able to answer
Who holds your domain, where does your email live, and when did someone last restore a backup? If any answer is a shrug, start here.
20 min readRead more
What a headless CMS is, in plain English
Your team keeps the editor they know. Visitors get a hand-built site that is fast and hard to attack. How the two halves fit, and when it is worth it.
19 min readRead more
Before you open a support ticket, start here
A quick status check can add useful context to a support request. Here is what to look for and how to describe a problem clearly.
27 min readRead more
ALCO has joined the Caldwell Chamber of Commerce
ALCO USA Inc is pleased to join the Caldwell Chamber of Commerce. We look forward to getting to know fellow members and taking part in the local business community.
25 min readRead more
Designing monitoring that earns its alerts
Most monitoring becomes noise within a year. How ALCO decides what wakes a person, what raises a ticket, and what is only recorded. Read the full approach.
40 min readRead more
Introducing ALCO Tools: a home for the small jobs
ALCO Tools brings everyday utilities into five clear categories, with file and text processing performed on your device.
25 min readRead more
Reuse is the real password problem
The weak password is rarely the one that gets you breached. The reused one is. Learn why credential reuse defeats otherwise sensible security controls.
37 min readRead more
The shared responsibility gap in Microsoft 365 and Google Workspace
Moving to a major cloud platform transfers much operational risk to the provider, but not all of it. Learn which part stays with you, and why it matters.
34 min readRead more
How to read a service-status page
A status page has its own vocabulary. Learn what the components, states and history sections mean, and what a green page does not actually prove.
26 min readRead more
The patch window problem: why known vulnerabilities are still the way in
The vulnerabilities used against mid-sized organizations are rarely novel: usually months old and already patched. Learn why the fix never got applied.
34 min readRead more
Building an everyday toolkit you trust
A shared shortlist of useful tools can make everyday file and formatting tasks easier to handle. Here is how to choose, document and maintain one for your team.
23 min readRead more
Migrating a production platform without downtime
How ALCO moves a live system onto new infrastructure: what we check first, the order operations must happen in, and the failure modes that cost weekends.
34 min readRead more
Zero trust for a business that isn't a tech company
The term is overused and oversold. Underneath it is a simple, practical idea most organizations can start applying without buying anything.
40 min readRead more
Same IT problem every week? Look beyond the workaround
Turn recurring interruptions into a clear starting point for investigation, so the same fault stops consuming the same hours every month. Read more.
27 min readRead more
Backups are not a recovery plan
Almost every organization we assess has backups. Far fewer have ever restored one. Learn why that gap is where the damage in a serious incident happens.
37 min readRead more
Your website needs more than a place to live
A website depends on more than disk space. Its platform, certificates, backups and changes need an appropriate plan and clear responsibility.
23 min readRead more
Your company name. Someone else's email.
A message impersonating your company can put customer trust at risk. Here is what you can control, what you cannot, and the check that tells you where you stand.
28 min readRead more
How to read a managed services agreement
The commercial terms in an MSP contract are usually simple. Scope, exclusions, data ownership and exit decide whether it works. Learn what to read closely.
33 min readRead more
A better first day starts before the first login
Accounts, a device, the right permissions and somewhere to get help. A preparation checklist that supports a useful first day and later access reviews.
27 min readRead more
The flat network problem
When every device can reach every other device, one compromised laptop becomes a path to everything. Segmentation is the unglamorous fix.
38 min readRead more
What break-fix really costs
Paying only when something breaks looks like the frugal choice. The arithmetic usually says otherwise once you count the downtime and the repeat visits.
34 min readRead more
Could someone send email as your company?
Your domain’s email configuration is an important part of the answer. Here is what SPF, DKIM and DMARC each do, and what a free check actually tells you.
27 min readRead more
What good IT reporting should tell you
If you fund IT but can't see what it's doing, you're paying on faith. Here's what a clear report should show — and why it matters to people well outside the server room.
36 min readRead more
Dependable technology takes ongoing attention
Monitoring, planned maintenance and investigation of recurring problems help a team understand its technology and decide what needs attention next.
27 min readRead more
Welcoming Carly Leveille to ALCO
Carly Leveille has joined ALCO, bringing customer-service experience and an entrepreneurial perspective to our family-led and operated business.
29 min readRead more
More time for the work that matters
A clearer support process helps your team handle everyday IT interruptions with less confusion, and gives you a record of where the time actually goes.
29 min readRead more
Small tasks deserve straightforward tools
File conversions, text cleanup and date calculations should be easy to understand. Here is how to choose a utility that fits the task and check its output.
24 min readRead more
Where to check your domain email protections
Bring your domain name and follow along. Here is the check itself, and a guide to four possible results and the questions to take to your domain administrator.
29 min readRead more
Clear scope, clear communication, real accountability
You should know what is included, who is responsible, and what happens next. Here is what that looks like in practice — and the questions that expose when it is missing.
22 min readRead more
On September 11, we remember
A moment of remembrance from everyone at ALCO USA Inc for the lives lost on September 11, 2001, and for the courage and service shown that day and in the years that followed.
15 min readRead more
Infrastructure as code for organizations that are not software companies
Infrastructure as code is usually explained by software companies to software companies. The idea is more broadly useful, and you need not become one.
32 min readRead more
Good work starts with connection
The most useful technology conversation is not about technology. It is about what your team is trying to do, where it gets stuck, and what would make the day easier.
26 min readRead more
The two numbers every recovery plan needs
RTO and RPO sound like jargon. They are really two questions about your business that you want answered on a calm day, not during an outage.
34 min readRead more
Three questions worth asking about your domain name
Who holds the registration, when does it expire, and is it locked against transfer? Here is how to answer all three, and what the public record genuinely cannot tell you.
25 min readRead more
Who really owns your domain name?
A domain lookup is a useful starting point. Confirming the registration arrangements, authorized account access and renewal responsibility takes a few additional checks.
27 min readRead more
Map the work before adding another tool
Identify repeated steps and unclear handoffs before choosing an automation or internal tool, so you are fixing the work rather than buying around it.
26 min readRead more
A clearer path through technology
A simple map of your website, hosting and everyday IT can help you understand dependencies and decide what needs attention next.
24 min readRead more
MFA is not a checkbox: what phishing-resistant authentication actually requires
MFA is the highest-value control most organizations can deploy, and it is routinely deployed in a form attackers walk straight through. Learn the difference.
38 min readRead more
SPF, DKIM and DMARC: why your domain is probably still spoofable
Most organizations have all three records in place. A surprising number have them configured just wrong enough to do nothing.
34 min readRead more
What an enterprise security review actually asks
Mid-market companies lose enterprise deals at the security questionnaire. Learn what reviewers check, which answers end a deal, and how to prepare early.
38 min readRead more
What an hour of downtime actually costs
Published downtime averages are enormous and nearly useless. Learn how to calculate a figure for your own business that will survive a finance review.
33 min readRead more
Your domain is a business asset
Your domain deserves a clear operational record: registration details, renewal responsibility, account access and service dependencies. Here is what to include.
25 min readRead more
Keeping a public website out of the incident queue
A marketing site is often the least critical system an organization runs and the most frequently compromised. Learn why that makes it the entry point.
38 min readRead more
Look beyond the sender name: a hierarchy of evidence
Logos and signatures can be copied and are not proof of a message’s origin. Ranking the signals from weakest to strongest gives a team a shared way to decide.
24 min readRead more
What “24/7” should mean in a managed services contract
Almost every provider advertises round-the-clock support. Learn who is actually awake, what they may do at 3am, and how to read the clause before signing.
37 min readRead more
Is it down, or is it just you?
When something stops working, the useful first question is how widely it is broken. A few safe checks reveal the scope and help support start faster.
25 min readRead more
Least privilege without breaking everything
Removing local administrator rights is high value and often abandoned. The projects that fail almost always fail the same way, and it is not technical.
36 min readRead more
What effective help-desk support should provide
A support function is a process, not a phone number. Triage, escalation and service history are what turn a queue of interruptions into problems that actually get solved.
27 min readRead more
The tools you didn't know you were running
Shadow IT is usually framed as a discipline problem. It is more often a sign that people needed something and had no sanctioned way to get it.
38 min readRead more
A better first day starts before day one
Prepare accounts, devices, access and support instructions before a new teammate arrives, and create records that help with later reviews and departures.
26 min readRead more
Start with what needs protecting
An inventory helps you connect security decisions to the systems, information and daily work your organization needs to protect. Here is a practical place to begin.
28 min readRead more
How to read an email header safely
The name in your inbox is free text. The delivery record behind the message is where the useful detail lives — here is how to read it, using a fabricated example.
25 min readRead more
Less busywork: start with one repeated task
A specific repeated task gives you a practical starting point for evaluating automation, simplifying a process, or removing unnecessary work.
26 min readRead more
Suspicious email? Here is how to follow the trail
Reading headers is only useful if you can retrieve them intact and hand them to the right person. This is the retrieval and escalation workflow, start to finish.
25 min readRead more
Build around the way your business actually works
A website, portal or internal tool should serve a purpose you can state in one sentence. Learn how to get from a vague requirement to something usable.
26 min readRead more
A September reset for your team’s technology
A short September reset for your team's technology, priorities and support needs, and a practical list of what is worth checking before the year closes.
25 min readRead more
Joiners, movers and leavers: the access problem hiding in plain sight
The most common security gap we find isn't exotic. It's the accounts and access nobody cleaned up when someone joined, changed roles, or left.
36 min readRead more