Thursday’s Nerds News is a security-first briefing — because right now, three separate threats are stacking up that can hit your small business before you even know what happened. A brand-new Windows vulnerability is stealing passwords without a single click. Cyber insurance carriers have quietly shifted from recommending MFA to denying policies over it. And Microsoft just announced a new way to govern the AI agents that are about to become part of every team’s day-to-day. We break all of it down and tell you exactly what to do this week.

Windows NTLM Zero-Click Attack Is Stealing Passwords From Thin Air (CVE-2025-24054)

This is the kind of attack that keeps IT professionals up at night. Attackers are emailing small .library-ms files to targeted victims, and the instant that file touches your hard drive — no double-click, no “open” — Windows Explorer automatically reaches out to an attacker-controlled SMB server and hands over your domain NTLM password hash. Those hashes are then cracked offline or used directly to impersonate the user on your network.

We understand how frustrating this is. You train your team not to click suspicious links. You run email filtering. You do everything right. And now there’s an attack where the user doesn’t have to do anything wrong at all. Here is what needs to happen at your business this week: confirm with your IT provider that every Windows endpoint has the March 2025 cumulative update (or newer) installed, and consider blocking outbound SMB (TCP port 445) at your firewall for any traffic leaving your network. Those two steps neutralize this attack. If you are not patched, you are exposed.

Cyber Insurance in 2026: Missing MFA Is Now a Flat Policy Denial

Cyber insurance carriers have crossed the line from “recommending” multi-factor authentication to “requiring documented proof of MFA on every login.” Marsh McLennan reports that 99% of 2026 cyber insurance applications now include specific MFA questions, and a staggering 41% of applications get denied on the first submission — with missing MFA cited as the number one reason.

This is not a yes/no checkbox anymore. Carriers want a screenshot of your Microsoft 365 conditional access policy, your VPN MFA configuration, your remote desktop gateway settings, and proof that MFA is enforced on every admin account and line-of-business application. If your renewal is this year, gather that documentation right now — not the week of renewal. The businesses that are ready are getting better rates. The businesses that are scrambling are paying more or getting dropped entirely. Your IT partner should be able to produce this documentation for you in under a day.

Microsoft 365 E7 and Agent 365: Microsoft Is Officially Treating AI Agents Like Employees

On May 1, Microsoft launches a new top-tier license called Microsoft 365 E7. On top of everything in E5, it bundles in Microsoft 365 Copilot, the full Entra Suite for identity governance, and — the really important piece — Agent 365, Microsoft’s framework for managing AI agents the way you manage employees. Badges, permissions, a manager, an onboarding checklist.

Most small businesses will not jump straight to E7 pricing. That is fine. The news is the idea itself: Microsoft is telling every business in the world that AI agents need governance. If your team is piloting Copilot or any other AI agent in 2026, you need a plan for who can build agents, what data they are allowed to touch, and what actions they are authorized to take. Ask your IT provider whether your current M365 plan covers any of this or whether you need to budget for a step up before the AI agent experiment becomes an AI agent sprawl problem.

Google Workspace Adds Guest Accounts — and Lets Employees Self-Purchase AI Add-Ons

Google Workspace just made two changes worth knowing about. First: guest accounts are now generally available, which means you can collaborate securely with customers, partners, or vendors who do not have a Workspace account of their own. This is a legitimate win. It ends the practice of sharing documents to personal Gmail addresses and losing all audit visibility the moment you do.

The second change is trickier. Starting April 7, individual users in eligible Business editions can now hit Google’s AI usage limits and self-purchase the AI Expanded Access add-on directly — without asking an admin. That means your employees can add charges to your company Google bill on their own. If you are a Workspace administrator, talk to your billing person today. Decide whether you want employee self-purchase enabled, and communicate the policy before someone has to explain a surprise line item at the end of the month.

Copilot Chat In-App Layout Changes on April 15

Heads up: Microsoft is updating how Copilot Chat appears inside Word, Excel, and the other M365 apps starting April 15. The web version of Copilot is unchanged, but the in-app entry points may move. If you have team members who rely on Copilot Chat inside Office, let them know ahead of time so they do not think Copilot disappeared.

HubSpot’s Free CRM Now Ships With AI Lead Scoring and Email Sequencing

HubSpot rolled out a meaningful upgrade to its free CRM tier this week: AI-powered deal closure predictions, automated email sequences, and intelligent contact management are now included at no cost. If your team is still tracking customers in a spreadsheet, this is a legitimate starting point that costs nothing and will give you a real CRM foundation to build on.

Key Takeaways: What To Do This Week

• Verify every Windows endpoint is on the March 2025 cumulative update or later; consider blocking outbound SMB (TCP 445) at the firewall.
• Gather documented proof of MFA enforcement across email, VPN, remote access, admin accounts, and line-of-business apps before your cyber insurance renewal.
• Start the conversation with your IT partner about AI agent governance — who can build, what data, what actions.
• Turn on Google Workspace guest accounts if you collaborate externally; decide whether to allow employee-initiated AI add-on purchases.
• Warn your team that Copilot Chat inside Word and Excel may look different starting April 15.
• If you do not have a real CRM yet, take a serious look at HubSpot’s free tier.

Don’t Face This Alone

Three of these stories — the NTLM attack, the insurance requirements, and AI governance — are exactly the kind of thing your business should not be trying to figure out by itself. At Advanced Computer Solutions, we help small businesses eliminate downtime and the frustration of reactive IT by building a custom Technology Peace Plan that covers patching, compliance documentation, and AI governance from day one.

Schedule a free IT consultation — we’ll meet, discuss your IT issues, and put a plan together so you can stop worrying about what’s breaking and get back to growing your business.

Want Nerds News in your inbox? Subscribe to our weekly briefing and never miss a story that affects your business.