Updated October 2026 to our current guidance. The original reporting date is unchanged.
Your vendors run their own security. Here’s the part that was always yours, and how to count it.
Count What’s on Your Computers →See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed.
You picked reputable vendors and cloud tools. That was a sound choice, and their security is theirs to run.
A vendor’s security covers the vendor’s systems. It has never covered your computers. So who is checking yours?
In this article
In June 2026 a crew called ShinyHunters worked through a list of companies. Kodak confirmed a breach after the group claimed 2.2 million records. JCPenney was on the list too, with Social Security numbers, W-2 tax forms, and scans of government IDs. The Council of Europe and American Tower were named as well. (source)
They didn’t break into each company one at a time. They got into one shared cloud platform, Salesforce and the apps connected to it, and pulled data from many companies through that one connection. The group claims more than a billion records taken this way over the past year. (source)
Your business data lives in more places than your own office: the payroll service, the accounting app, the customer database in the cloud. Each of those vendors secures its own systems, and you can’t inspect them.
What you can see is the other end of the connection: the computers your people use to log in to all of it. Those are yours, and nobody else is going to count what’s on them.
Two things are in your hands.
First, the computers. Windows Update never touches third-party software. The browser, the PDF reader, and the other programs your team uses every day update on their own schedule, or not at all. Count which ones are current and which need updating.
Second, the emails that tend to follow a big breach. In my experience, fake “reset your password” and “confirm your account” messages show up soon after a breach makes the news, aimed at people whose details were exposed. Make it a habit to go to the vendor’s site directly instead of clicking the link.
You built a business to serve your customers. Auditing a dozen other companies was never part of that. Feeling exposed by someone else’s problem is normal.
I’ve spent 35+ years watching how these attacks work. The part of a vendor breach you can act on is almost always on your side of the connection, and it starts with knowing what’s on your own machines.
Here is what happens when you click the button.
If the second number is higher than you expected, that’s common. You don’t have to be able to do this. We’ll do it with you.
The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
It only looks and reports. It doesn’t change anything on your computer. No credit card needed to start.
Your results are yours, and we don’t sell your data. If you buy anything later, refunds are available within the first 30 days.
Everyone starts with the scan. Most people stop there, and that’s a fine outcome. If you want more, there are two other ways we work.
Run it on each Windows computer. It counts what is installed: how many programs are current and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
Count What’s on Your Computers →For a business that gets asked to prove its security, by a bigger customer, an insurer, or an auditor. We scan your computers every month, a person reviews the results, and you get a prioritized report you can hand over. Whoever runs your IT keeps doing the work; you get a dated record of where the computers stand. Up to 100 computers, from $4,500 a year.
See how Second Opinion works →If you would rather have the work done for you: the updates, the monitoring, and the problems when they come up. Every business is set up differently, so we scope it in a conversation.
Start a conversation →Agreed. You can’t fix the vendor. You can know where your own computers stand, and if a bigger customer ever sends you a security questionnaire, that’s exactly what they’ll ask about.
The scan gives you two counts per computer. If everything is current, the report says so.
The Reveal Scan counts what is installed on each Windows PC: how many programs are current and how many need updating. Read-only, no credit card needed.
Count What’s on Your Computers →The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you run it and never speak to us again, that’s a fine outcome.
Want this kind of plain-English security news every week? Sign up for Craig’s Insider Notes at CraigPeterson.com.
Join the owners who get Craig's Insider Notes every week.