Why Construction Is an Easy Target

BEC works when a fake request blends into a busy day. A typical project has a general contractor, an owner, a lender, an architect, a dozen or more subcontractors, and suppliers, all trading invoices, pay applications, change orders, and lien waivers by email. Much of that information is easy to find. Bid results, permit filings, and project announcements tell an attacker who is building what, and roughly when money will move.

Three habits in the industry raise the risk:

• Payments are large and routine. A six-figure draw or progress payment doesn’t stand out, so nobody looks twice.
• Work happens in the field. Project managers and superintendents approve requests from phones on jobsite Wi-Fi, often between other tasks. Verizon’s 2026 Data Breach Investigations Report found that text and voice scams aimed at mobile users succeed at a rate 40% higher than traditional email phishing.
• Your risk includes your partners. The same Verizon report found third-party involvement in 48% of breaches. If a sub’s or supplier’s mailbox is compromised, the fake invoice arrives from a real address you already trust.

Metro Atlanta’s steady pipeline of commercial, residential, and infrastructure work means plenty of firms here fit that profile, from specialty subs to general contractors.

How a Construction BEC Scheme Plays Out

Most schemes follow the same pattern:

1. Access. An attacker phishes a password from someone at your firm, a sub, or a supplier, or registers a lookalike domain one letter off from the real one.
2. Observation. Inside the mailbox, they read quietly for days or weeks, learning project names, payment timing, and who approves what. Many set up hidden forwarding rules so they keep seeing replies.
3. The ask. Right before a payment is due, they send a polished request to update banking details, often with a letter on company letterhead and an urgent deadline.
4. The transfer. The payment goes out. The real vendor calls weeks later asking where their money is.

The FBI’s own examples match this closely, including “a vendor your company regularly deals with sends an invoice with an updated mailing address” and a homebuyer who receives wiring instructions from what looks like their title company.

Controls That Stop It

BEC depends on one unchecked step, and a few simple controls remove it.

Verify every banking change by phone. When a vendor asks to change payment details, call them at a number you already have on file, never the number in the email. The FBI’s guidance is to verify payment requests “in person if possible or by calling the person to make sure it is legitimate.” Make this a written policy with no exceptions for urgency.

Require two people for large payments. A second approver for new payees, changed bank details, and anything above a set dollar amount catches what one busy person misses.

Turn on multi-factor authentication for every email account. A stolen password alone shouldn’t open your inbox. Our guide to multi-factor authentication for small business covers where to start.

Lock down your email domain. Email authentication settings (SPF, DKIM, and DMARC) make it harder for anyone to send mail that pretends to come from your company. Add a visible “external sender” tag to outside messages and alerts for new forwarding rules.

Protect field devices and connections. Keep phones and tablets updated and managed, and keep jobsite Wi-Fi separate from systems that handle money. We cover the Wi-Fi side in what is the disadvantage of guest Wi-Fi for businesses.

Talk to your partners. Tell subs and suppliers in writing that you will never change payment instructions by email alone, and ask them to follow the same rule.

If a Payment Has Already Gone Out

Speed matters more than anything else. The FBI advises victims to contact their financial institution immediately and ask it to contact the receiving bank, then file a complaint at ic3.gov. In 2025, the FBI’s Recovery Asset Team froze about $679 million of the $1.16 billion it worked to stop, a 58% success rate. Every hour of delay makes recovery less likely.

The Practical Takeaway

Write a one-page payment verification policy this week: phone verification at a known number for any banking change, dual approval above a set amount, and a clear rule that urgency never skips a step. Share it with your accounting team, project managers, and top vendors.

Build Payment Security Into Your Operations

Firms working on defense-adjacent projects have even more reason to tighten email security, as we explain in why the CMMC Phase 2 suspension is no reason to stop preparing. Eclipse Networks helps construction companies secure email, field devices, and the systems behind every draw and invoice. Explore our security and data protection services, or schedule a Cybersecurity Risk Assessment to find the gaps before an attacker does.

The post Business Email Compromise in Construction: How to Protect Draws, Invoices, and Vendor Payments appeared first on Eclipse Networks.

We never expected what happened next!

A Gift Built for the Weekend

Anyone who has worked with Michael knows where he goes when he’s off the clock. Michael is an RC pilot, one of the hobbyists who build, fly and maintain radio-controlled aircraft. The hobby takes patience, a steady hand and a willingness to troubleshoot when something doesn’t go to plan. Sound familiar? It’s a pretty good description of a career in IT, too.

“We wanted to give Michael something he’d actually use, and that meant paying attention to what he lights up about when he’s not at his desk,” said Kathy Ryerse, CFO of Eclipse.  “After ten years, we knew the answer.”

Michael Came Back With a Surprise

A few weeks after his last day, Michael stopped by the office with the finished plane. On the side, he’d added the Eclipse logo. Then he asked Steve and Kathy to sign it!

Did you know? In the flying community, signing an aircraft is a tradition. A signature marks the people who were part of that plane’s story. Michael wanted his first plane of retirement to carry the names of the two people who’d been part of his story for more than a decade.

“I’ve signed a lot of things in this job: contracts, checks. None of them meant as much as signing the wing of Michael’s plane,” said Steve Ryerse, President of Eclipse. “He took a piece of Eclipse with him, and he made sure we knew it.”

When you work alongside someone for over ten years, you learn more than how they handle a server migration. You learn their family’s names, how they take their coffee and what they’re building in the garage. That kind of familiarity doesn’t come from an org chart. It comes from time.

Long tenure matters to our clients, too. When the same technician picks up the phone year after year, they already know the network, the history and the people behind it. Problems get solved faster because nobody has to start from scratch.

“Clients notice when the person on the other end of the line has been there for years,” said Kathy. “Michael knew our clients’ environments inside and out, and you can’t hire that kind of continuity. You keep it by taking care of the people who build it.”

Your Next Career in Technology Starts Here

At Eclipse, we believe great work comes from people who have full lives outside the office. That means knowing what our team cares about, celebrating the milestones that have nothing to do with tickets, and showing up for each other when it counts, including on the way out the door.

Michael’s plane now flies with the Eclipse logo on its side and Steve and Kathy’s signatures on its wing. We’re proud to be along for his next chapter, and we’re looking for the people who’ll write the next one here.

“When people have room to chase what they love, they bring that energy back to work,” said Steve. “That’s how you build a team that lasts.”

If you’re looking for your next career in technology, join the team that supports your passions in and out of the office!

The post Cleared for Takeoff: Celebrating Michael Smallwood’s Retirement appeared first on Eclipse Networks.

Phishing Is Still How Many Attacks Start

Verizon’s 2026 Data Breach Investigations Report found a human element in 62% of breaches. Phishing was the way in for 16% of breaches, and stolen or misused credentials accounted for another 13%. The FBI’s Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints in 2025 alone, according to its 2025 IC3 annual report.

The goal of phishing is to gain your password. With one working login, an attacker can read your email, reset passwords on other accounts, and write to your clients from an address they already trust.

The lures are also moving off email. Verizon found that fake text messages and phone calls succeed at a rate 40% higher than traditional email phishing. Your team’s phones are now part of the front line.

What is Multi-Factor Authentication?

Multi-factor authentication (MFA) adds a second check after the password. That check might be a code from an app, a tap on a phone, a fingerprint, or a physical security key. A stolen password on its own is no longer enough to get in.

The results are hard to argue with. Microsoft research on real-world accounts found MFA reduced the risk of compromise by 99.22%, and by 98.56% even when the password had already leaked.

Some MFA Holds Up Better Than Others

Attackers have adapted to MFA, so the type you choose matters. Common tricks include:

• Flooding a user with push prompts until someone taps “Approve” to make them stop
• Calling an employee while posing as IT support and asking them to read back a texted code
• Building a fake login page that passes the password and code to the real site in real time

Some MFA is better than no MFA, and phishing-resistant MFA is the standard to aim for. Today, the only widely available phishing-resistant option is FIDO/WebAuthn, the technology behind passkeys and hardware security keys. If that isn’t practical yet, CISA suggests number matching, where the user types a number shown on the login screen, to blunt push-flooding attacks.

Our post on the death of the password and what comes next covers passkeys in more depth.

Where to Turn On MFA First

Rank your accounts by what an attacker could do with them, then work down the list:

1. Email. Microsoft 365 or Google Workspace is the master key, because every other password reset lands there.
2. Remote access. VPNs, remote desktop tools, and cloud admin portals.
3. Banking and payments. Online banking, payroll, and any platform that can move money.
4. Systems that hold client data. Case management, electronic health records, accounting, and project management platforms.
5. Your password manager. It protects everything else, so it needs the strongest lock.

Don’t forget accounts that slip through the cracks: logins shared by a team, accounts that belonged to former employees, and admin accounts that only get used a few times a year.

Training Your Team to Spot the Phish

Technology filters out a lot. People catch the rest. Teach your team to slow down when a message shows any of these signs:

• Urgency or secrecy, such as “I need this before 3 p.m. and don’t loop in accounting”
• A sender address one character off from the real one, or a reply-to address that doesn’t match
• A request to change payment details, buy gift cards, or approve an MFA prompt nobody expected
• A link whose real destination, visible on hover, doesn’t match the text

The habit that matters most is reporting. An employee who flags a suspicious email within minutes gives IT time to pull the same message from every other inbox. Make reporting quick and blame-free, and thank people who do it. We dig into the people side of security and review why most security incidents start without hackers.

For Atlanta businesses in finance, law, healthcare, and construction, the inbox is where money and confidential data move every day. That makes it the first place attackers aim, and the first place to lock down.

Getting Started This Week

Set aside 30 minutes this week for one check. Confirm MFA is on for every email account in your company, including shared logins and accounts for people who have left. Then choose the three most valuable systems from the list above and confirm MFA there too. Finish by telling your team exactly how to report a suspicious message, and who to call.

Working with Eclipse to Understand Your Risk

Most businesses have MFA turned on somewhere. The gaps are what attackers look for. An Eclipse Networks Cybersecurity Risk Assessment shows where MFA is missing, which accounts carry the most risk, and where your team could use training, all in plain language with a prioritized plan. Learn more about our security and data protection services, or schedule a consultation to get started this Cybersecurity Awareness Month.

The post Multi-Factor Authentication for Small Business: How to Stop Phishing From Becoming a Breach appeared first on Eclipse Networks.

Georgia’s Data Breach Law

Georgia’s breach notification rules, rooted in the state’s Personal Identity Protection Act, require businesses that own or license computerized data to notify affected individuals when their personal information is compromised.

What counts as personal information. Georgia defines it as an individual’s first name (or first initial) and last name combined with a sensitive data element — a Social Security number, driver’s license number, financial account or card number, or in many cases medical or account-access information. If your systems hold that combination for customers or employees, you’re covered.

How fast you must act. Notification must happen “in the most expedient time possible and without unreasonable delay” after you discover the breach. Georgia doesn’t hand you a comfortable fixed window — the expectation is prompt action, and “we were still figuring it out” is not a defense.

When the Attorney General gets involved. If a breach affects more than 10,000 Georgia residents, you’re generally required to notify the state Attorney General as well, and the AG’s office handles enforcement. You can review the state’s official consumer and business guidance on identity theft and breaches through the Georgia Attorney General’s Consumer Protection Division.

Why “we’re too small to be a target” is the wrong mindset

The businesses hit hardest by these rules are usually the ones who were sure they’d never need them. Attackers don’t skip small companies — they favor them, precisely because defenses tend to be thinner. And the compliance burden isn’t reserved for enterprises. As we’ve written about how compliance now reaches businesses of every size, a small Georgia business is held to the same notification law as a large one, with fewer resources to absorb the fallout.

The direct cost of notification and investigation, the legal exposure, and the customer trust that’s hard to win back once people learn their data was exposed and — worse — that you were slow or unclear about telling them. This law is also just one piece of a broader shift in Georgia’s regulatory environment that we covered in which new Georgia laws in 2026 business owners should actually care about.

Getting ready before the clock starts

The law rewards preparation, because the requirements assume you can move quickly and knowledgeably the moment a breach is discovered. That’s hard to do from a standing start.

Know what data you hold and where it lives. You can’t protect — or report on — information you haven’t mapped. Knowing where personal information sits across your systems is the starting point for protecting the systems, data, and devices that hold it.

Reduce the odds you’ll ever send a notification. Strong access controls, encryption, employee training, and monitoring are what keep a breach from happening in the first place. This is the core of ongoing cybersecurity and incident response, and it’s far cheaper than the alternative.

Have an incident response plan ready. When a breach hits, you need to know immediately who does what, how you determine who was affected, and how fast you can notify. A plan built in advance — paired with reliable backup and data protection — is the difference between an orderly response and a scramble that turns a bad day into a legal problem.

Work with an Eclipse Cybersecurity Expert

If you hold customers’ or employees’ personal information and it’s exposed, you must tell affected people promptly, and the Attorney General too when a breach is large. The businesses that handle this well aren’t the ones with the biggest legal teams — they’re the ones who mapped their data, hardened their systems, and wrote an incident response plan before they needed one. The ones who wait learn the requirements the hard way, on the worst day of their year.

Eclipse Networks helps Georgia businesses stay ahead of exactly this — securing the data you’re responsible for, building incident response plans, and making sure that if the worst happens, you can respond quickly and correctly. If you’re not sure where your customer data lives or how you’d respond to a breach, schedule a consultation and we’ll help you get ready before the clock starts.

The post What Georgia’s Data Breach Notification Law Now Requires of Small Businesses appeared first on Eclipse Networks.

Will Living Near a Data Center Raise Your Bill?

It’s the fair concern. Data centers consume enormous amounts of electricity, and the natural worry is that homes and small businesses will end up subsidizing them. Georgia regulators moved to prevent exactly that.

The Georgia Public Service Commission approved rules requiring any new large-load customer — including AI data centers — that expects to draw 100 megawatts or more to operate under a customized contract rather than standard rates. Those contracts carry financial guarantees, terms up to 15 years, and minimum monthly payments, and the PSC ordered Georgia Power to design rates so residential and small business customers don’t foot the bill for generation built mainly to serve data centers. As 11Alive reported when the rule passed, the intent is that “data centers will need to bear the cost of their electricity acquisition.” There’s also a Georgia Power rate freeze in place through the end of 2028.

The rules are designed to protect you from cost-shifting, but energy pricing and reliability in a high-demand grid are worth watching. It’s a good moment to understand your own power costs and continuity plan rather than assume nothing will change.

The Upside Most Business Owners Miss

The boom isn’t just something happening to your business. It creates real advantages you can use.

World-class cloud and connectivity, locally. All that infrastructure — fiber-dense connectivity, massive colocation capacity, competitive industrial power — is the same backbone your business can tap for cloud services. Being in one of the country’s densest data center markets means fast, reliable, geographically close cloud hosting and cloud co-location options that businesses in other regions can only wish for. If you’ve been running an aging on-premise server, the economics of moving to a modern cloud environment have rarely looked better.

A deeper technology talent pool. The same forces drawing data centers — Georgia Tech, Emory, and one of the Southeast’s largest concentrations of tech talent — are strengthening the whole regional technology ecosystem. That benefits any Atlanta business trying to modernize, whether you hire directly or work with a local partner.

A reason to get your own AI foundation ready. The infrastructure powering the AI wave is being built in your backyard, which makes this the moment to ask whether your business is positioned to use AI at all. As we covered in everything you need to know about AI in cybersecurity, AI is already reshaping both how businesses operate and how they’re attacked — and being ready means having clean data, modern systems, and solid security in place first.

What Can You Do About Living Near a Data Center?

You don’t need to build a data center to benefit from living next to dozens of them:

• Review your energy and continuity exposure. Rules protect you from cost-shifting, but a high-demand grid is a reason to make sure your business can keep running through an outage — the foundation of any real security and data protection strategy.
• Reconsider your cloud strategy. With premier hosting and co-location on your doorstep, keeping critical systems on a single aging server in a closet is harder to justify. Local cloud can mean better performance, stronger resilience, and predictable costs.
• Plan before you spend. Whether the boom means moving to the cloud, adopting AI, or simply hardening your systems, the smart first step is a clear-eyed look at where you are and where you want to be — the kind of roadmap a virtual CTO is built to provide.

Working with Eclipse to Manage Your Data

The Atlanta data center boom is one of the biggest infrastructure stories in Georgia’s history, and it cuts both ways for local businesses. The risk — higher energy costs — is largely being managed by state regulators on your behalf. The opportunity — access to premier cloud infrastructure, a deeper talent pool, and a strong reason to modernize — is yours to take or ignore. The businesses that treat this as a prompt to get their technology foundation in order will be positioned to use what’s being built. The rest will just watch the construction cranes go up.

Eclipse Networks helps Atlanta-area businesses turn regional infrastructure into a real advantage — moving to secure, modern cloud environments, planning technology roadmaps, and keeping operations resilient. If you want to understand what the boom means for your specific business, schedule a consultation and we’ll help you make the most of it.

The post Atlanta Is Now a Data Center Capital. Here’s What It Means for Your Business. appeared first on Eclipse Networks.

The gap between “this is amazing” and “this is a violation” is narrower than most practice owners realize, and it usually comes down to a few specifics no vendor demo highlights.

Medical AI Scribes

Under HIPAA, any vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate — and an ambient AI scribe does all four. It listens to the encounter, processes the conversation, and generates documentation. That makes a signed Business Associate Agreement (BAA) non-negotiable before the tool touches a single patient visit.

This is not a technicality. If PHI reaches a vendor without a BAA in place, both you and the vendor are in violation the instant data is sent — even if nothing is ever breached. The HHS Office for Civil Rights has settled cases for millions of dollars where the only failure was a missing agreement. The HHS guidance on business associates and HIPAA spells out the obligation clearly. Before you enable any AI tool, the first question is simple: will they sign a BAA, and what does it actually commit them to?

Beyond the Chart Notes

Here’s what practices routinely underestimate. A single ambient-scribe encounter doesn’t just produce the note that lands in the EHR. It typically generates a live audio recording of the conversation, an interim transcript, a machine-drafted note, and metadata about the clinician, patient, and visit. Under the HIPAA Security Rule, every one of those artifacts is electronic PHI you are responsible for safeguarding — including the copies sitting on the vendor’s servers.

That reality drives the questions your BAA and your vendor review need to answer:

Does the vendor encrypt PHI in transit and at rest? How long is data retained, and can you require deletion? Critically, does the vendor use patient data to train or fine-tune its AI models — and does your agreement explicitly prohibit it? Are sub-processors disclosed? A tool can absolutely be HIPAA-compliant, but only when the vendor signs a BAA, encrypts PHI, limits retention, and keeps your patients’ data out of its training pipeline. If a vendor won’t answer these plainly, that’s your answer.

Beyond HIPAA Compliance

This is the trap catching practices in 2026. Meeting HIPAA does not immunize you from state and federal wiretap laws, which can require patient consent to record a conversation. A high-profile class action against Sutter Health and MemorialCare alleges they used an ambient AI scribe to record patient-clinician conversations without informed consent — raising claims under California’s Invasion of Privacy Act, the Confidentiality of Medical Information Act, and the federal Wiretap Act. Reporting on the Sutter/MemorialCare case shows how a HIPAA-compliant tool can still create serious legal exposure if patients aren’t properly informed.

The practical fix is straightforward: build patient consent and clear notice into your workflow before you record anything. Tell patients an AI tool is being used, document their agreement, and know your state’s recording-consent rules.

Security Rule Requirements

Some practice owners assume this level of scrutiny is for big hospital systems. It isn’t. As we’ve written about how compliance now reaches businesses of every size, a two-provider clinic carries the same core HIPAA obligations as a health system — with far fewer resources to absorb a penalty. And these AI obligations sit on top of the broader Security Rule requirements we covered in what HIPAA compliance now requires of healthcare organizations. Getting the underlying environment right — access controls, encryption, and backup and data protection — is what makes safe AI adoption possible in the first place.

Working with an Eclipse AI Expert

AI compliance for medical practices comes down to a short checklist you can run before turning on any AI scribe or chatbot: Get a signed BAA that prohibits model training on your data. Confirm encryption, retention limits, and disclosed sub-processors. Build patient consent and notice into the workflow to satisfy wiretap laws, not just HIPAA. And make sure the environment underneath — access controls, encryption, backups — is actually sound. Do those four things and you get the productivity without the liability. Skip them and a tool meant to save time becomes the most expensive mistake in the practice.

Eclipse Networks helps medical practices across Georgia and Florida adopt AI safely — vetting vendors and BAAs, securing PHI across every system that touches it, and building the cybersecurity and data protection foundation HIPAA requires. If you’re evaluating an AI scribe or chatbot and want to be sure you’re covered, schedule a consultation before the tool goes live — not after.

The post AI Compliance for Medical Practices: Using Scribes and Chatbots Without Breaking HIPAA appeared first on Eclipse Networks.

The contractors pulling ahead aren’t the ones who bought the flashiest software first. They’re the ones whose foundation was ready when the software arrived.

The Importance of Data

Look at what today’s construction AI actually depends on:

Predictive scheduling analyzes weather patterns, supply-chain signals, and your project history to flag delays before they hit. It’s only as accurate as the schedule and project data you’ve kept current.

AI estimating and takeoff uses computer vision to quantify materials straight from drawings — a huge time saver, but only if your drawings and cost data are organized and accessible in one place, not scattered across email threads and a server in the trailer.

Drones and reality capture (the DroneDeploy capability now feeding Procore AI) turn site photos into progress tracking and automated observations, as The Robot Report detailed when the acquisition was announced. That only pays off if the captured data flows back into a system your office actually uses.

Every one of these assumes the same thing: that your field and office share information cleanly, your data is consolidated, and your crews can reach it from wherever the work is. For a lot of construction firms, that assumption breaks down the moment you leave the office parking lot.

AI on the Job Site

Readiness isn’t a mindset or a budget line. It’s four concrete conditions, and you can check your company against each.

Connected field-to-office data. The single biggest barrier to construction AI is the gap between the trailer and the back office. When daily logs live on paper, RFIs live in email, and the schedule lives in one person’s head, AI has nothing reliable to learn from. Getting your project data into connected systems — and getting rid of the “final_v3” spreadsheet problem — is the unglamorous work that makes every AI feature above perform. It’s the same foundation behind any real digital transformation for a small or mid-sized business.

Reliable jobsite connectivity. Drone capture, mobile approvals, and cloud-based plans are worthless if the site has no signal. Readiness means solving connectivity at temporary locations — cellular failover, jobsite Wi-Fi, secure remote access — so the field isn’t cut off from the tools it’s supposed to use.

Secure mobile devices. Construction runs on phones and tablets in trucks, on scaffolding, and in the mud. Those devices hold project financials, client data, and platform logins. If they aren’t managed, encrypted, and protected with multi-factor authentication, every one is a door into your business. Strong cybersecurity and data protection isn’t separate from AI readiness — it’s part of it.

A cloud foundation and a plan. Most of these platforms are cloud-native and expect you to be too. A firm still anchored to an aging on-site server fights the tooling at every step. Deciding which systems you need, how they integrate, and what to fix first is exactly the kind of planning a virtual CTO provides — mapping technology to how you actually build before you spend on licenses. A properly configured cloud environment gives these tools the accessible, secure data layer they’re designed for.

Start with the Right Foundation

There’s a pattern here worth noticing, because it’s the same one we described for law firms getting ready for AI: the winners fix the foundation first, then choose the AI that fits. The firms that struggle start with a subscription and discover the hard way that AI can’t repair broken data plumbing or reach a jobsite with no signal. It just runs on top of the mess, faster.

Early results show what’s possible when the foundation is solid. One contractor that paired AI-augmented modeling with drone-based progress monitoring reported 92% of major projects finishing on time, up from 71% before adoption, with material waste down 9%. That’s the payoff — but it comes from the systems underneath, not the logo on the software.

Working with an Eclipse AI Expert

Before your company commits to Procore AI, an estimating tool, drones, or predictive scheduling, run a simple AI-readiness check: Is our project data connected between field and office? Can our crews reliably reach it from the jobsite? Are our mobile devices secured and managed? Are we operating in a modern cloud environment? If any answer is no, that’s where the real work is — and doing it first is what separates contractors who gain an edge from AI from those who just get a bigger bill and a frustrated team.

Eclipse Networks helps construction companies across Georgia and Florida build that foundation — connecting field and office systems, solving jobsite connectivity, securing mobile devices, and standing up the cloud environment construction AI depends on. If you’re weighing these tools and want to know whether your systems are ready, schedule a consultation and we’ll help you build the base before you buy the tool.

The post AI Readiness for Construction Companies: What to Fix Before Roll Out appeared first on Eclipse Networks.

But here’s what the vendors won’t tell you in the demo: AI readiness for law firms has almost nothing to do with which tool you buy. It has everything to do with whether the systems underneath it are clean, connected, and secure enough to trust an AI on top of them.

The best legal AI pointed at messy data, disconnected systems, and loose security will only multiply your problems faster. Before your firm signs up for any of these platforms, the foundation is what determines whether you get value or a very expensive disappointment.

Popular legal tech platforms today

Look at what some of the law firms we work with depend on:

Harvey and CoCounsel generate research, summaries, and first drafts — but their output is only as good as the documents and matter data you feed them. Garbage in, confident-sounding garbage out.

Litify runs on Salesforce and unifies matter management, intake, billing, and documents into one system, with AI built in. Its value comes entirely from having your data structured and centralized in the first place — Litify’s platform is built on Salesforce, AWS, and Anthropic infrastructure.

Clio brings AI into practice management through Clio Duo, but it can only reason over the matters, contacts, and time entries you’ve actually kept organized in it.

RingCentral adds an AI layer (RingSense) that transcribes and analyzes client calls and can even route inbound calls automatically. It’s a powerful system, but only if it integrates cleanly with your case management system for tracking messages and notes. RingCentral integrates with Clio, Litify, and other legal platforms.

Every one of these tools assumes something about your firm: that your data is organized, your systems talk to each other, and your security can withstand pointing an AI at privileged client information.

How to avoid stalling on AI projects

Readiness isn’t a mindset. It’s four concrete conditions, and you can check your firm against each one:

• Clean, structured data. AI is a reflection of what you give it. If your matters live half in a case management system, half in email, and half in a shared drive named “Documents_FINAL_v3,” an AI tool will surface the wrong version, miss context, and produce answers you can’t rely on. Getting your matter data consolidated and consistent is the unglamorous work that makes every AI feature above actually perform.
• Systems that connect. The real payoff comes when your phone system, case management, document storage, and research tools share information instead of sitting in silos. That requires deliberate integration and, often, a cloud foundation built to support it. Sorting out which systems you need and how they fit together is exactly the kind of planning a virtual CTO exists to do — mapping your tools to your workflow before you spend on licenses.
• Security that can hold privileged data. This is the one that should keep managing partners up at night. Feeding client information into an AI tool raises immediate questions of confidentiality, privilege, and your ethical duty to protect client data. That means enforced multi-factor authentication, controlled access, clear data-handling rules, and knowing exactly where client information goes when a tool processes it. AI readiness and strong cybersecurity and data protection are the same project — you cannot responsibly do the first without the second.
• A modern cloud backbone. Most of these platforms are cloud-native and expect you to be too. A firm still anchored to an aging on-premise server and a patchwork of local files will fight the tooling at every step. A properly configured Microsoft 365 and cloud environment gives AI tools the secure, accessible data layer they’re designed to work with.

Establishing the right technology foundation

The firms getting real value from legal AI started by getting their house in order. They consolidated data, integrated systems, tightened security, and then layered AI tools on top. The firms struggling started with a subscription and discovered the hard way that AI can’t fix a broken foundation.

You don’t need an in-house IT department to get there. Many firms handle this through a co-managed or outsourced IT partnership.

Schedule an AI Readiness Assessment

Before your firm commits to Harvey, CoCounsel, Litify, Clio, RingCentral, or anything else, run a simple AI-readiness check: Is our matter data clean and centralized? Do our core systems actually connect? Can our security stand up to privileged data flowing through an AI? Are we operating in a modern cloud environment? If the answer to any of those is no, that’s where the real work is.

Eclipse Networks helps law firms build that foundation, from organizing and securing data, integrating case management and communications, to standing up the cloud and security environment that legal AI depends on. If you’re weighing an AI platform and want to know whether your systems are actually ready for it, schedule a consultation and we’ll help you build the base before you buy the tool.

The post AI Readiness for Law Firms: Getting Your Systems Ready for Harvey, CoCounsel, and Beyond appeared first on Eclipse Networks.

But before you tell your team to stand down, understand exactly what got paused and what didn’t. Because the obligation that actually matters is still fully in force, and contractors who treat this as a break are setting themselves up to lose work.

We covered the original rollout in CMMC Compliance Is Now a Contract Requirement. This is the other side of that story: what the pause changes, what it doesn’t, and why the smart move is to keep going.

The CMMC suspension

CMMC, or the Cybersecurity Maturity Model Certification, was designed to do one thing that decades of self-attestation hadn’t: verify that contractors were actually meeting the security requirements they’d been promising to meet. Phase 2 was the teeth. It would have required many contractors handling Controlled Unclassified Information (CUI) to pass an assessment by an accredited third-party organization (a C3PAO) before they could be awarded a contract.

That verification requirement is what’s on hold. On July 13, 2026, the DoD suspended Phase 2, stood up a CMMC Reform Task Force reporting to the DoD Chief Information Officer, and opened a review period expected to run about 60 days. In plain terms: for now, you won’t be required to hire a third-party assessor to certify your Level 2 compliance before winning a contract. WilmerHale’s client alert lays out the mechanics.

What did not change

CMMC was never the source of a security obligation. It was a layer of enforcement built on top of rules that already existed and are still on the books:

• DFARS 252.204-7012 still requires you to implement the security controls in NIST SP 800-171 if you handle CUI. That clause has been in defense contracts since 2017. It’s untouched.
• NIST SP 800-171 — all 110 controls — still defines your security baseline. Nothing about the Phase 2 suspension lowers that bar.
• DFARS 252.204-7019 and 7020 still require you to complete a self-assessment and post a current score in the Supplier Performance Risk System (SPRS), and to affirm it. That score is a live, enforceable data point the government can pull up at any time.

The suspension removed the referee, not the rules. You still have to meet the standards. You still have to score yourself against them. You still have to stand behind that score. As one legal analysis put it, the deadline is gone but the legal obligation isn’t.

Why “we’ll wait and see” is the expensive choice

It’s tempting to read a suspension as permission to slow down, but here’s why that would be a mistake:

• Your prime contractors aren’t waiting. If you’re a subcontractor, your security requirements don’t come only from the DoD — they flow down through the prime contractor above you. Primes with mature security programs are still writing 800-171 compliance into their subcontracts and still asking for evidence. The government pausing Phase 2 doesn’t release you from what your customer requires to keep doing business with them.
• A false SPRS score is still legal exposure. Because self-assessment and SPRS reporting remain mandatory, an inflated or stale score is exactly what it was before the suspension: a misrepresentation the government can act on, including under the False Claims Act. The pause on third-party verification arguably makes your self-reported number more scrutinized, not less.
• The requirement is coming back. A reform task force reviewing the program is not the same as the program going away. When verification returns — in whatever form the review produces — the contractors who kept working the 110 controls will be ready to certify quickly. The ones who stopped will be scrambling, competing for assessor slots, and potentially locked out of awards while they catch up.

Working with Eclipse Networks on CMMC

Treat the CMMC Phase 2 suspension as a schedule change, not a reprieve. The finish line for third-party certification moved. The work required to reach it did not. If you were on track to meet NIST SP 800-171, stay on track. If you were behind, use this extra time to close control gaps, improve your SPRS score, and document your System Security Plan and Plan of Action & Milestones properly.

Contractors who keep building through the pause turn a moment of uncertainty into a competitive edge: when the requirement firms up again, they’re already compliant while competitors are still assessing.

Eclipse Networks helps defense-supply-chain businesses across Georgia and Florida meet NIST SP 800-171, calculate and correct their SPRS scores, and build the security and data protection foundation that CMMC will ultimately verify. If you want a clear-eyed read on where you actually stand against the 110 controls, schedule a consultation — before the deadline comes back on someone else’s timeline.

The post CMMC Phase 2 Just Got Suspended. Here’s Why You Shouldn’t Stop. appeared first on Eclipse Networks.

Back-to-school cybersecurity isn’t a topic for the school district’s IT department. For any business owner with remote or hybrid staff, it’s a real exposure that shows up in your systems, your data, and your bank account.

The truth is that the person who lets an attacker into your business is almost never trying to. It’s a distracted employee, a shared family computer, or a kid chasing a shortcut in a video game.

The breach that started with a Roblox cheat

In February 2026, an employee at a company called Context.ai went looking for Roblox “auto-farm” scripts and game cheat tools — the kind of thing a kid or a gaming parent downloads without a second thought. What actually got installed was Lumma Stealer, a piece of infostealer malware that quietly harvested corporate credentials from the machine: Google Workspace logins, plus keys for several business tools.

Those stolen credentials sat in a criminal database for over a month. Attackers then used them to break into Context.ai, steal access tokens, and pivot into the systems of one of its customers — the developer platform Vercel. By the time Vercel disclosed the breach in April 2026, a threat actor was selling the stolen data for $2 million. All of it traces back to a single game exploit downloaded onto a work-connected machine. CyberScoop reported the full chain of events.

You don’t have to be a tech company for this to matter. The pattern — a game download, an infostealer, harvested business logins — is now one of the most common ways small businesses get compromised.

Why it’s not “just a home computer”

A similar story played out at Disney. An employee downloaded what looked like a free AI image tool onto his personal home computer. It was infostealer malware. It sat undetected for five months, scraped his saved passwords, and gave an attacker the keys to Disney’s internal Slack. They walked off with more than a terabyte of company data. The employee wasn’t careless at work. He was careless at home, on a device he thought had nothing to do with his job.

That’s the core problem. Your employees’ home devices now hold corporate logins, and those devices are shared with kids, spouses, and roommates who aren’t thinking about your business at all. Verizon’s 2025 Data Breach Investigations Report found that 46% of unmanaged devices showing up in infostealer logs had corporate credentials on them. Nearly half. These are personal laptops and home machines quietly carrying the keys to a business network.

No, you don’t have to ban your kids from the internet.  But a work credential on an unmanaged, shared home device is like leaving your storage room unlocked.

Four ways home risk gets into your business

The specifics vary, but back-to-school exposure tends to come through the same doors:

• Shared devices. A parent finishes work, and the kid uses the same laptop to play games or do homework. Malware doesn’t know whose turn it is.
• One flat home network. The work laptop, the smart TV, the kids’ tablets, and the gaming console all sit on the same Wi-Fi with no separation. Once one device is infected, it can see the others.
• “Free” downloads. Game mods, cheat tools, pirated software, and fake apps are among the most reliable ways to deliver infostealers — and they’re exactly what kids seek out.
• Saved passwords. When work logins are saved in a personal browser or password manager on a shared machine, one infection can hand over dozens of accounts at once.

What actually reduces this risk

You can’t supervise every household your team works from. You can make sure a mistake at home doesn’t become a breach at work. A few practical moves do most of the work:

Give employees a dedicated work device and a clear rule that it’s not the family computer. Separating work from personal use is the single highest-value step, and it’s the foundation of the basic security habits every business should have in place.

Segment the home network. A guest Wi-Fi network for kids’ devices and personal gadgets — separate from where the work laptop connects — keeps an infected tablet from reaching a work machine. Proper network and Wi-Fi configuration is straightforward to set up and easy to overlook.

Manage the devices that touch your data. Endpoint protection, automatic updates, and the ability to see and respond to threats on remote machines turn “we hope nobody clicked anything” into “we’d know if they did.” This is the heart of ongoing cybersecurity and incident response.

Turn on multi-factor authentication everywhere it’s offered. Even if credentials are stolen, MFA gives an attacker one more wall to climb.

Working with a cybersecurity expert at Eclipse Network

Assume the home network is hostile, and design your business so a single mistake there can’t reach everything. Separate work devices from family ones, split the home network, keep managed protection on anything that touches company data, and require MFA. None of it requires a lecture to your kids. It just requires treating remote work like the extension of your business it actually is.

If you’re not sure how exposed your team’s home setups leave you, that’s worth an honest look before the school year hits full stride. Eclipse Networks helps Atlanta-area businesses close exactly these gaps — securing remote devices, segmenting networks, and putting monitoring in place so a household mistake stays a household mistake. Schedule a consultation and we’ll help you find the weak points before someone else does.

The post Your Kid’s Homework Could Be Your Company’s Next Breach appeared first on Eclipse Networks.