The Week in Workplace Tech: AI Costs, Safer Collaboration and a More Practical Cyber Defence

For small and mid-sized organisations, the technology story this week is less about shiny new tools and more about control. AI is moving deeper into everyday work, collaboration platforms are becoming security boundaries, and cyber defence is shifting towards earlier detection and better business planning.

Introduction

The past seven days, from September 18 to September 25, 2026, have produced a useful set of signals for business leaders. Microsoft has outlined a more structured approach to AI at work, including the need to manage usage-based costs. Microsoft has also announced a more integrated model for security operations as attackers increasingly use automation and AI.

Elsewhere, Microsoft Teams is preparing to give administrators more control over risky file types, while new guidance from the US Cybersecurity and Infrastructure Security Agency encourages organisations to use cyber decoys such as honeytokens and honeypots. A workplace technology study has also highlighted a familiar but expensive problem: IT teams are still being involved too late in office and collaboration planning.

The common thread is straightforward. Technology decisions now affect productivity, security, compliance and operating costs at the same time. Businesses that treat these areas separately may find themselves paying more for avoidable friction and preventable risk.

1. AI at work is becoming a cost and governance issue

Microsoft used a recent AI at Work update to describe a commercial model that combines standard user subscriptions with usage-based billing for more advanced agentic work. In practical terms, some AI capabilities may be priced according to how much work an agent performs rather than simply how many employees have access.

That distinction matters for smaller businesses. A conventional software subscription is relatively easy to forecast. Agentic workloads can be less predictable because an automated system may run longer jobs, process larger amounts of information or carry out repeated actions across business applications.

This does not mean organisations should avoid AI. It does mean that approving an AI tool for every employee without setting boundaries could create an unpleasant surprise when invoices arrive. It also raises governance questions about what employees are allowed to connect to an AI assistant, which business data it can access and who remains accountable for its output.

Microsoft’s announcement is vendor-specific, but the wider trend is industry-wide. AI providers are experimenting with combinations of per-user licences, usage allowances, credits and task-based pricing. Business leaders should expect more than one charging model to appear across their software portfolio.

Why it matters for businesses

AI can deliver real value in research, customer service, document preparation, sales administration and internal knowledge management. However, the return on investment will be difficult to prove if usage is not measured against a defined business outcome.

There is also a risk of uncontrolled duplication. Different teams may independently subscribe to AI services, upload company information into public tools or build overlapping automations. That can increase costs while making privacy, retention and access controls harder to manage.

Practical recommendations

• Start with two or three clearly defined use cases where time savings or improved service can be measured.
• Create an approved AI tools register and record the owner, data access, expected cost and business purpose for each service.
• Set usage limits, spending alerts and approval thresholds before enabling advanced AI features.
• Require human review for customer-facing, financial, legal, employment or compliance-sensitive outputs.
• Train staff not to paste confidential information into consumer AI tools unless the business has approved the service and its data handling arrangements.
• Review AI licences monthly and remove unused access, duplicate tools and experiments that have not produced measurable value.

The key lesson is to treat AI as an operating capability, not just another application. That means budgeting, ownership, monitoring and change management should be agreed before the technology becomes embedded in daily workflows.

2. Security operations are being redesigned for an automated threat environment

Microsoft’s security team announced an integrated security operations centre model in a recent Microsoft Security article. The company said attackers are using agents and automation to increase the speed and scale of their activity, while defenders often still work across disconnected tools and manual hand-offs.

The proposed direction brings security information and event management, threat protection, investigation and response closer together. Microsoft’s argument is that people and defensive agents need shared signals, context and controls if they are to respond quickly enough to automated attacks.

For a small business, this does not mean buying an expensive enterprise security operations centre overnight. The more important point is architectural. Security tools should work together, and the people responsible for responding to alerts need enough context to decide what to do next.

A business may already have endpoint protection, cloud security, identity monitoring, email filtering and backup alerts. If those systems do not share information, a suspicious login can remain disconnected from an unusual file download or a new administrator account. The result is more noise, slower investigation and a greater chance that an attack will spread before anyone understands it.

Why it matters for businesses

Cybercriminals do not need to compromise every system to cause disruption. They may only need one stolen account, one exposed remote service or one convincing message to gain a foothold. Automation allows attackers to test credentials, search for valuable data and move between systems faster than a small internal IT team can manually investigate.

An integrated approach can help smaller organisations reduce alert fatigue and improve escalation. It can also make outsourced IT and managed security services more effective because the provider has a clearer view of the environment.

Practical recommendations

• Map your current security tools and identify where alerts are isolated or regularly missed.
• Make sure identity, endpoint, email, cloud and backup events are visible to the person or service responsible for incident response.
• Define a short list of high-priority alerts, such as impossible travel, new privileged accounts, disabled security controls and unusual mass downloads.
• Use automated actions carefully, starting with low-risk responses such as forcing a password reset or isolating a clearly compromised device.
• Test your incident response plan with a scenario involving a stolen Microsoft 365 or Google Workspace account.
• Ask your IT provider how quickly an alert is reviewed, who is contacted after hours and what evidence is retained for investigation.

The practical goal is not to automate every security decision. It is to make sure the right information reaches the right person quickly, while leaving high-impact decisions under appropriate human control.

3. Microsoft Teams is becoming a more important security boundary

Microsoft is preparing an update that will allow Teams administrators to customise which file extensions are blocked. The change, reported by TechRadar Pro, builds on Teams Weaponizable File Protection, which already scans potentially dangerous attachments.

The planned control is expected to give organisations a choice between Microsoft’s recommended block list and a list tailored to their own security requirements. The reported target for broader rollout is November 2026, so businesses should use the lead time to review their current Teams settings and file-sharing habits.

Teams and similar collaboration platforms have become central to business operations. Staff exchange documents, links, spreadsheets, images and project files in chats that may feel more trusted than email. That sense of familiarity can work in an attacker’s favour, particularly when a message appears to come from a colleague or supplier.

Blocking file extensions is not a complete defence. Attackers can rename files, use archives, share links or persuade users to download content from an external site. However, reducing the types of files that can be sent directly through a collaboration platform can remove common opportunities for malware delivery.

Why it matters for businesses

Small organisations often have strong email filtering but less mature controls around chat and file collaboration. That creates a gap. If Teams, Slack or another platform is treated as an informal communication channel rather than a business system, administrators may overlook retention, access, monitoring and malware controls.

The issue is also relevant to compliance. Organisations should be able to explain where business records are shared, who can access them and how risky content is restricted. A clear file-sharing policy can support privacy obligations, customer contracts and cyber insurance requirements.

Practical recommendations

• Review file-sharing settings across Teams, Slack, Google Workspace and other collaboration tools.
• Identify file types that your business never needs to exchange through chat, especially executable and script formats.
• Keep approved alternatives available, such as managed document libraries or secure file-transfer services.
• Restrict external users and guest access to the teams and channels where it is genuinely required.
• Remind staff that a message from a familiar account is not automatically safe, particularly if it contains an unexpected file or urgent request.
• Enable logging and alerting for unusual sharing activity, large downloads and new external collaborators.

Businesses should avoid creating controls that simply frustrate employees. The best policy explains what is blocked, why it is blocked and what approved process staff should use instead.

4. CISA is recommending cyber decoys that smaller businesses can actually use

The US Cybersecurity and Infrastructure Security Agency has published guidance encouraging organisations to use cyber decoys, including honeypots, honeytokens, breadcrumbs and tripwires. The advice was covered in a recent security report.

A cyber decoy is designed to look like a legitimate system, account or piece of data, but it is not part of normal business activity. If an attacker accesses it, the event can produce a high-confidence alert. Examples include a fake administrative account that no employee should use, a document containing a monitored link or a dummy file share with no legitimate purpose.

The value is that decoys can help detect attackers who use valid credentials and legitimate administration tools. Traditional security products may struggle to distinguish normal activity from malicious use when an intruder is operating with a real account.

CISA positions decoys as a complement to Zero Trust rather than a replacement for access controls, patching or multifactor authentication. They can also be introduced gradually, which makes the approach more accessible to businesses with limited budgets.

Why it matters for businesses

Many small organisations do not have a security analyst watching every alert. A well-designed decoy can reduce the number of false positives by creating events that should not happen during normal work.

There is a caution, however. Decoys must be documented, monitored and maintained. A fake account with an unknown owner can create confusion, while an abandoned honeytoken may stop working after a system change. The technique is most useful when it is tied to an agreed response process.

Practical recommendations

• Begin with one or two low-risk honeytokens in areas that attackers are likely to explore, such as privileged account lists or sensitive file shares.
• Document every decoy, its purpose, its owner and the exact response expected when it is triggered.
• Send alerts to a monitored mailbox, managed security service or ticketing system rather than relying on a dashboard nobody checks.
• Test the alert path during a tabletop exercise and confirm that the event is visible outside the affected system.
• Review decoys quarterly and remove any that are no longer relevant or could confuse staff.
• Never place real customer information, production credentials or sensitive operational data inside a decoy environment.

For a small business, the aim is not to build an elaborate trap. It is to create a few reliable indicators that tell you when someone may be looking where they should not be.

5. Workplace technology still fails when IT is brought in too late

A new Logitech Workplace Experience study, reported by TechRadar Pro, found that technology teams are often involved after major decisions about offices, meeting rooms and workspaces have already been made.

The report said fewer than one in three UK workplaces involve IT and audio-visual teams before space planning begins. It also reported a median productivity loss of 12.2 minutes per person per poor meeting when audio fails or connections drop.

The specific figures come from a vendor-backed workplace study and should be treated as directional rather than universal. The underlying business problem is familiar, though. Organisations often buy rooms, furniture and communication systems separately, then expect employees to have a seamless hybrid experience.

This can create unnecessary cost. A room may have the wrong acoustics, incompatible displays, unreliable wireless coverage or a camera that does not work well with the chosen meeting platform. Fixing the issue later is usually more expensive than involving IT, facilities and users during planning.

Why it matters for businesses

Productivity loss does not always appear as a line item. It shows up as meetings that start late, staff repeating information, customers waiting for a connection and employees avoiding collaboration tools that they do not trust.

For Australian businesses managing distributed teams across cities, regional areas and time zones, dependable workplace technology is especially important. It affects recruitment, employee experience, customer service and the ability to use office space efficiently.

Practical recommendations

• Include IT, facilities, HR and representative end users at the beginning of office and meeting-room projects.
• Measure technology downtime, failed meetings and support tickets alongside traditional workplace costs.
• Standardise meeting-room hardware and software where possible to reduce training and support overhead.
• Test rooms under real conditions, including background noise, lighting, wireless congestion and remote participation.
• Create a replacement and maintenance plan rather than waiting for equipment to fail.
• Ask staff which technology problems cost them the most time, then use that feedback to prioritise improvements.

A reliable meeting room is not a luxury. It is part of the operating infrastructure that allows people to work, sell, serve customers and make decisions.

What This Means For Your Business

The major lesson from this week’s technology news is that productivity and security are now tightly connected. AI agents can help people work faster, but they also introduce new spending patterns, data access questions and accountability requirements. Collaboration tools can reduce email overload, but they also need the same attention to access, monitoring and malware controls as other business systems.

Business leaders do not need to respond to every announcement with a new project. A sensible first step is to review the systems your staff use every day and ask four questions: what information can they access, what could go wrong, how would we know, and who is responsible for fixing it?

Over the next 30 days, consider setting an AI usage policy, reviewing Teams and collaboration settings, checking that critical security alerts are monitored, and measuring the time lost to workplace technology failures. These are practical actions that can improve resilience without requiring a major transformation program.

The organisations best placed to benefit from the next wave of technology will not necessarily be those with the biggest budgets. They will be the ones that introduce new capabilities with clear ownership, sensible guardrails and a regular habit of measuring whether the technology is improving the business.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.