Good morning, and happy almost-Halloween — we made it to the end of the week, which is more than I can say for my prep schedule this morning. Today’s show covers a lot of ground: plain-English analytics tools that let small shops actually read their own business data; record metalworking machinery orders and what that means for fabricators; Microsoft’s February 2027 deadline to kill SMS two-factor logins; a hosting company seizure that’s a good reminder to check who’s holding your data; and a quick word on fixing your data before you point an AI tool at it.
Let’s get into it.
Free live webinar · Wed, Nov 18 · 12:00–12:30 PM ET
Shadow AI: What Your Staff Are Already Doing (and the 30-Minute Fix)
The AI your team is already using that you never approved — what it puts at risk, and a simple three-step fix. The last 10 minutes are your questions, live.
Save my seat →Your Business Data Can Finally Talk Back
For a long time, business intelligence tools were priced and designed for enterprise companies — the kind that have a dedicated data team, a statistics person, and a junior analyst who builds complicated queries while everyone else waits three weeks for a report. If you ran a machine shop or a dental practice or a service operation, you mostly just… didn’t get that. You had QuickBooks and a gut feeling.
That’s changing fast, and it’s interesting to watch.
There’s a company called Plain English Analytics doing this, but the concept is bigger than any one vendor. The mechanism is APIs and MCP connectors — those are just the pipes that let one system talk to another. In this case, the “other system” is an AI that can read everything flowing through those pipes and turn it into something a human can actually use: tables, spreadsheets, documents, a web page, whatever format makes sense for what you’re trying to answer.
Your ERP. Your MRP. Your accounting system. Your medical records platform if you’re in healthcare. The data is already there. It’s been sitting there. The connectors are what unlock it.
Now, a word of caution before you get excited and start plugging things together: where that data goes matters enormously. Connecting your business systems to a free AI account — the kind that trains on your inputs — is not the move. If you’re paying for a plan, you still need to find the checkbox that says “do not use my data for training.” It’s usually buried. It’s always worth finding.
Alert readers will notice that this is basically the same data-permissions conversation we keep having, just with a new front end on it. The underlying principle doesn’t change: know where your data is going, and make sure you’ve explicitly told it not to leave.
Record Metalworking Orders — and What to Do This Week If You Run a Shop
This one made me happy. December orders for metalworking machines hit a new monthly record, according to data from the National Association of Wholesale Distributors. That’s a signal that manufacturing demand is building upstream, and if you run a small machine shop, a fabrication operation, or any business that supports larger producers, more potential work could be heading your way.
My dad ran a machine shop back in the seventies — Bridgeport mills, engine lathes, all the machines that used to be built right here. Watching that work get offshored was painful. So I’ll take any data point that suggests we’re building more of it back. I hope it’s real and not just an association putting a good face on things. Worth a call to two or three of your existing customers or distributors this week to ask them directly whether they’re actually seeing increased demand.
If the answer is yes, the practical question becomes: are you ready to grow? New machines need network drops. New machines generate data — cycle times, utilization, error codes — and that data can feed your ERP and your AI tools so you actually know how your floor is performing. A quick capacity audit now is a lot less painful than scrambling when the orders show up.
Microsoft Is Killing SMS Login in February 2027 — Here’s What to Use Instead
SMS two-factor authentication — where a website texts you a code and you type it in — has been the default second factor for a lot of Microsoft 365 accounts for years. It’s better than nothing. It is not, however, good.
The problem is SIM swapping. Your cell number can be stolen by convincing your carrier to transfer it to a new SIM card. Once that happens, every text-based code goes to the attacker. And I’ll be direct: I would not trust AT&T or Verizon to be the security backstop for your business login. Their account security practices are not where you want your protection chain to end.
Microsoft is pulling the plug on SMS and voice-call authentication in February 2027. That’s roughly fifteen months from now, which sounds comfortable until you realize that “fifteen months” has a way of becoming “this weekend” in IT project time.
What should you use instead? Passkeys are my first choice — they’re cryptographically solid and, once set up in a password manager, they’re seamless. The Microsoft Authenticator app with a six-digit rotating code is also excellent. The code lives on your phone, it’s not transmitted over the carrier network, and it doesn’t depend on AT&T having a good day.
The practical step this week: log into your Microsoft Admin Center and check how your users are currently authenticating. If you see SMS or voice call in there, start planning the migration now. It’s not a hard change, but it does need to happen for every user, and doing it under deadline pressure is no fun for anyone.
A Hosting Seizure and a Quick Data Housekeeping Note
US law enforcement seized a hosting company called VirtualLine because it was widely used by ransomware groups. I find this interesting from a policy standpoint — if you operate a platform that’s known to be infrastructure for criminal activity, apparently the answer is that the whole platform goes away. Which makes sense, but it’s also a useful reminder.
If your business data — backups, hosted applications, anything — lives with a provider you can’t verify as legitimate, you’re one enforcement action away from an unplanned outage that has nothing to do with anything you did wrong. Use recognizable, established hosting providers. It’s not exciting advice, but it’s the kind that saves you a very bad Tuesday.
Anyway. The related point, which we also touched on in the show: fix your data before you connect an AI tool to it. If your permissions are wrong and an AI starts pulling information, it will share what it finds with whoever it thinks should see it — which might be everyone in your organization, or in a worst case, further than that. Getting your data organized and permissioned correctly isn’t a prerequisite you can skip just because the AI tool looks ready to go.
That’s the week. Go get some candy tonight — we’re one good day away from Halloween and I think we’ve all earned it. Talk soon.
— Albert
Want to go deeper on any of this? join my free Nov 18 webinar on Shadow AI — we cover topics like these in more detail and you can bring your questions live. And if something we covered today is already on your to-do list, schedule a free IT consultation and we’ll walk through it with your business in mind.
Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Chicagoland.