Cloud Security Moves From IT Concern to Business Priority

Cloud services remain one of the biggest enablers of growth for small and mid-sized organisations. They are also becoming the place where identity attacks, software vulnerabilities and third-party failures converge.

The past seven days have delivered a useful warning for Australian businesses: cloud security is no longer only about keeping servers patched. It is about protecting identities, controlling SaaS connections, understanding supplier exposure and making sure the business can keep operating when a trusted platform or device becomes a target.

1. Passkey-themed scams are targeting cloud identities

Microsoft has reported an active campaign in which attackers use phone calls, text messages and convincing sign-in pages to impersonate IT support. The lures often mention passkeys, single sign-on or multifactor authentication. Once a user is persuaded to authenticate, attackers can capture sessions, register their own authentication method and move through Microsoft 365 services.

The campaign is particularly relevant because it does not necessarily look like traditional phishing. A user may receive a call on a personal mobile, be directed to a familiar-looking Microsoft page and complete a legitimate authentication step without realising that an attacker is controlling the session. Microsoft says observed activity has included reconnaissance through Microsoft Graph, abnormal access to SharePoint and OneDrive, and collection from Exchange Online. The company has also advised organisations to investigate the sequence of events rather than relying on one suspicious IP address or domain. Microsoft Security research provides the technical background.

Why it matters for businesses

A compromised cloud identity can give an attacker access to far more than email. Depending on the user, it may expose customer records, financial documents, contracts, payroll information, business plans and internal applications. In a small business, one compromised manager or administrator may have access across multiple systems.

There is also an important communications risk. If an attacker uses a compromised Teams or email account to contact colleagues, suppliers or customers, the message may appear trustworthy. That can turn a single account compromise into a wider fraud or malware incident.

Practical actions

• Make passkeys or other phishing-resistant authentication the preferred option for administrators, finance staff, executives and anyone with access to sensitive data.
• Create a simple rule that staff must never approve an unexpected MFA request or complete a passkey enrolment after an unsolicited phone call.
• Give employees a verified support channel, such as a known internal number or service desk portal, for checking suspicious authentication requests.
• Restrict authentication-method registration to managed devices, trusted locations or a stronger authentication policy.
• Review new MFA methods, new devices, unusual sign-ins and high-volume file downloads at least weekly.
• If an account is suspected to be compromised, revoke sessions, remove unauthorised authentication methods, reset credentials and check mailbox rules and application consent.

Microsoft has also confirmed that passkeys are becoming the default authentication experience for Microsoft Entra ID users from September 1, 2026, with Microsoft-provided SMS and voice authentication scheduled to end on February 1, 2027. Organisations should treat the change as a security improvement, but plan user communications and recovery processes carefully. Microsoft Entra guidance sets out the transition timetable. citeturn2search0turn2search1turn2search10

2. A record-sized Microsoft patch cycle puts pressure on smaller IT teams

Microsoft’s September security update addressed nearly 1,000 vulnerabilities across its product portfolio, according to industry coverage of the release. A further update was issued after the initial release caused compatibility and stability problems on some Windows systems, including issues affecting graphics, file sharing and other integrations. Industry coverage of the September update and follow-up reporting on the emergency update highlight the operational challenge.

The lesson for SMEs is not to delay every update because some patches may cause disruption. It is to improve the process around updates. Patching is now a business activity that needs testing, prioritisation and rollback planning, not a task that can be left until someone has time.

Why it matters for businesses

Most smaller organisations rely on Microsoft 365, Windows devices, cloud identity and a mix of remote access tools. A vulnerability in any of those layers can affect business continuity, insurance obligations, customer confidence and compliance reporting.

At the same time, a rushed update can interrupt a line-of-business application, break a printer or disrupt a remote access workflow. The answer is a risk-based process that separates urgent security fixes from routine feature changes and tests the most important business functions before broad deployment.

Practical actions

• Maintain a current inventory of laptops, servers, network appliances, cloud applications and business-critical integrations.
• Define patching service levels, such as same-day assessment for actively exploited vulnerabilities and a short deadline for internet-facing systems.
• Use a small pilot group of representative devices before deploying major operating system updates across the entire workforce.
• Confirm that backups, recovery credentials and rollback procedures work before applying large update cycles.
• Ask your managed service provider for a monthly patch report that identifies overdue devices and exceptions.
• Record why a patch was delayed, who accepted the risk and when the decision will be reviewed.

Microsoft also patched 18 vulnerabilities across Azure services and Copilot-branded products during the week. Many of those fixes were applied on the service side, meaning customers did not need to install software themselves. That does not remove the need for review. Customers should still confirm whether any affected features are in use, whether client-side updates are required and whether monitoring should be adjusted. SecurityWeek’s summary provides an overview of the affected Azure and AI services. citeturn1news22turn1news13turn1search0

3. Cisco identity infrastructure remains a high-value target

Cisco published an advisory on September 16 covering multiple vulnerabilities in Identity Services Engine and the ISE Passive Identity Connector. The affected products help organisations manage network access, authentication and identity-aware security controls. Cisco said the vulnerabilities could allow remote attackers to access or manipulate data, obtain sensitive information or cause a reload of certificate and key material. Software updates were released and Cisco stated that no workarounds were available. Cisco’s security advisory contains the affected versions and remediation details.

Many SMEs do not operate Cisco ISE themselves, but the issue is still relevant. Network access systems are often managed by a provider, hosted in a data centre or embedded in a wider security service. Businesses may therefore be exposed without knowing which product version supports their guest Wi-Fi, VPN, office network or endpoint access controls.

Why it matters for businesses

Security appliances are attractive targets because they sit at a control point. If compromised, they may provide visibility into users, devices, network segments and access policies. They can also undermine other controls by allowing an attacker to appear as a trusted device or user.

The broader message is that vulnerability management must include outsourced infrastructure. A business cannot assume that a managed firewall, wireless platform or access-control system is patched simply because a supplier operates it.

Practical actions

• Ask every technology provider to confirm whether Cisco ISE, ISE-PIC or related identity infrastructure is present in your environment.
• Request confirmation of the installed version, affected status, update date and any compensating controls.
• Review remote administration access for network and security appliances, including MFA, source restrictions and privileged account use.
• Separate management interfaces from ordinary user networks wherever possible.
• Monitor administrator logins, configuration changes, certificate activity and unexpected device registrations.
• Add security appliances and managed services to the same risk register used for laptops and cloud applications.

For Australian organisations, this is also a useful prompt to review supplier evidence. Contracts should state who monitors advisories, who applies emergency updates, how incidents are reported and how quickly the provider must respond to a critical vulnerability.

4. A SaaS supply-chain incident shows how third-party apps can reach customer data

BigCommerce has warned merchants about a data incident involving compromised credentials for third-party Ribon applications. According to reporting, attackers used those credentials to inject malicious scripts into a small number of online stores and access customer information in affected environments between September 13 and September 17. The platform removed the applications after confirming the compromise. Reporting on the BigCommerce incident describes the known timeline and impact.

The incident is a practical example of SaaS concentration risk. A business may have strong passwords and MFA on its main platform, yet still be exposed through an app, plugin or integration that has been granted access to customer data.

Why it matters for businesses

Third-party applications can process orders, send marketing messages, update customer records, create invoices or inject scripts into a website. They often receive permissions during a quick implementation and remain connected long after the original business need has changed.

For online retailers, professional services firms and other customer-facing businesses, an incident can create several costs at once: notification obligations, investigation fees, lost sales, customer complaints, reputational damage and possible regulatory scrutiny.

Practical actions

• Keep a register of every SaaS integration, plugin, marketplace app and automation connected to business systems.
• Review the permissions granted to each integration and remove access that is broader than necessary.
• Disable unused applications and rotate secrets when a supplier changes staff, ownership or operating arrangements.
• Ask suppliers how they protect application credentials, detect abuse and notify customers of an incident.
• Use separate service accounts for integrations rather than personal administrator accounts.
• Test whether a compromised integration could read, change or publish customer data, and document the response steps.

SaaS convenience is valuable, but convenience should not mean permanent and invisible access. A quarterly review of connected apps is a manageable starting point for most SMEs.

5. Cloud and AI security are becoming the same conversation

The latest Microsoft disclosures also show how closely cloud infrastructure and AI services are now linked. The September fixes covered Azure infrastructure, data services, AI development platforms, Microsoft Fabric and Copilot products. At the same time, security researchers continue to report attacks that combine identity compromise, cloud APIs and automated data collection.

This does not mean businesses should avoid AI or cloud platforms. It means new projects need security guardrails before they scale. An AI assistant connected to email, documents or customer systems is not just a productivity tool. It is a user or application with access, permissions and an attack surface.

Why it matters for businesses

Small businesses often adopt AI through a quick trial, a browser extension or a SaaS subscription. The technology may be useful before anyone has decided what data it can access, whether prompts are retained, who can approve actions or how activity will be audited.

Poorly governed AI can create privacy, confidentiality and operational risks even without a conventional cyberattack. Sensitive information may be copied into an external service, an automated agent may act on incorrect instructions, or an attacker may use a compromised account to search data through an AI-connected workflow.

Practical actions

• Create a simple approved-use policy for generative AI, including what information staff must never upload.
• Record which AI tools and assistants are approved, who owns them and what business data they can access.
• Apply least privilege to AI integrations and review permissions whenever a new connector is enabled.
• Require human approval for actions involving payments, customer communications, access changes or deletion of records.
• Log important AI activity and include AI-connected services in incident response exercises.
• Review vendor terms for data retention, training use, breach notification, regional hosting and subcontractors.

What This Means For Your Business

The common thread across this week’s news is that attackers are aiming at trust. They are abusing trusted identities, trusted cloud platforms, trusted network controls and trusted third-party integrations. For a small or mid-sized organisation, the most effective response is not to buy every new security product. It is to make the existing environment easier to understand and harder to abuse.

Start with a short review of privileged accounts, authentication methods, connected SaaS applications, network appliances and business-critical backups. Confirm who owns each area, who receives alerts and how quickly the business can contain a problem. If a supplier manages the technology, ask for evidence rather than relying on assumptions.

Most importantly, turn security guidance into repeatable business routines. Patch on a defined schedule, review access regularly, train staff to challenge unusual requests and practise recovery before an incident occurs. These steps reduce risk while also improving resilience, compliance readiness and customer confidence.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.