I said October 19. It's October 19.

The Deck Log, Issue 1

1. Log Entry

Position: day one. Morale: caffeinated. Coffee reserves: critical

When my daughter was nine, I drove her to the doctor's office. She was supposed to be at her friend's house.

From the back seat I hear: "Why are we here? How long until we get to my friend's house?"

"I just need to run in and talk to them quickly."

She bought it. I walked into the doctor's office, used their restroom with the confidence of a man who had an appointment, and walked back out. Then I drove her to her friend's like that had been the plan all along.

She trusted me to remember. I didn't. That was the first time I noticed the calendar in my head was running out of room.

Nexus started years before it had a name, as a place to keep phone numbers. Then came tasks tied to those people. Then clients. Then something to nudge me before I dropped the next person. I had more people than one head can hold, and I cared too much to keep letting them slip.

On October 1, I put October 19 in a public post so I couldn't move it again. It worked, the way locking your keys in the car works to make sure you walk to the office. Nexus is open.

Every couple of weeks, I'll tell you what has changed and what I learned, and I'll ask you one question. Your answers shape what gets built next.

I'm glad you're here.

2. Changelog

Since Last Time: (there was no last time, so this covers a few weeks, a lot of coffee, and one argument I had with myself)

The argument: Contracts. You can now send a contract and get it signed without leaving Nexus, and without anyone needing a Docusign account. Docusign is excellent, but it's built for companies much bigger than us, and connecting it would have cost each of you days of setup. We use BoldSign instead. You also get more contracts per month.

Added: A choice. nerthos.com now asks before it counts your visit. Click Allow, and your visit joins the totals: the page, how you found us, your country, browser, device type, and page speed. Click No thanks, and nothing is sent. No tracking cookies, nothing that follows you around. The full list, including the one soft spot, is in the Privacy Policy.

Started: The road to SOC 2. The audit logging has been running since before Nexus opened, because those logs need months of history. The paperwork starts in November. I'll report progress here.

Fixed: The calendar picker that showed only half a calendar. The left half.

Next: More UI bugs. Fewer every week. Next time, this section will have your fingerprints on it.

3. From the Desk

A customer calls and asks where their job stands. You know the answer. It's in an email, or a text, or the spreadsheet, or a sticky note. By the time you find it, they've had time to wonder.

Harvard Business Review counted 1,200 app switches a day, close to four hours a week spent just getting your bearings back. Four hours a week is about five weeks a year. That's a vacation you spend looking for things. I wrote about where that time goes and how to get some of it back.

Also from the desk:

Safeguards shouldn't be an upsell. Most software saves security for its top plan. Here's what Nexus puts on Free, and why.

The spreadsheet nobody else can open. You know the one. What to do about yours this week.

4. Out There

News from beyond Nexus: what happened, what to do about it, and what I think. No sirens.

Firewall lockouts

On October 6, the FBI and Secret Service warned about attackers breaking into Fortinet firewalls and VPNs, the boxes that sit between an office and the internet. Once inside, they steal sign-in details, create admin accounts of their own, and sometimes delete yours, so you're locked out of your own front door. The advisory is blunt: the latest update isn't enough. If someone already has your passwords, a patch doesn't take them back. If your office has a Fortinet box at the edge, this one is yours.

Here's what I think. Don't read this as a Fortinet story. Back in June, researchers at the Cloud Security Alliance traced the same playbook hitting other firewalls, network storage boxes, database servers, and remote desktop portals. The method isn't exotic. Attackers guess passwords, reuse ones stolen elsewhere, and crack the rest with powerful computers. Fortinet has hardened its defenses since, and that's good. But the real weakness is any door on the internet that opens with a password alone. That's on all of us who keep leaving those doors open. And it's on every software company that still sells the second lock as an upgrade. If one of yours does, ask them why, in writing.

Do this: Forward this to whoever runs your network. Have them turn off internet-facing admin pages, reset VPN and admin passwords, check for accounts nobody recognizes, and require a security key or passkey. Locking your keys in the car is a funny story. Locking yourself out of your own firewall isn't.

Copilot billing

Microsoft 365 Copilot is splitting in two. Everyday AI stays on the per-user license you already pay for. The heavy, high-powered models move to pay-as-you-go, and nothing gets charged until an admin sets up a spending policy. If you're on Microsoft 365, this one is yours. (ChangePilot)

Here's what I think. Yes, Microsoft is splitting Copilot. No, this change doesn't raise your bill. Some businesses will save money by choosing where the heavy models are worth it. What worries me is how stories like this get used. Someone will wave this headline at a business that hasn't read the details and say daily AI is about to get expensive. Will costs rise eventually? Yes. Nobody knew how much infrastructure AI would need, and demand keeps climbing. Some of that money pays for research into capacity, performance, even cooling, the work that makes it cheaper to run later. That's paying for growth. Know the difference before someone sells you the fear.

Do this: Open Copilot's cost settings in your admin center. If you create a spending policy, put a cap on it. It's the rare bill that waits for you to say yes. Make sure you're the one who says it.

The ding problem

In Verizon's 2026 Data Breach Investigations Report, phishing on phones drew 40 percent higher click rates than phishing by email. If anyone on your team has a phone, this one is yours. (Verizon DBIR)

Here's what I think. An email can sit for two days. A text dings, and you look. Email got safer because we spent years on it: filters that catch phishing before you ever see it, training, better settings. Not safe, but safer. There are more reasons, but I'll stop before you get tired of reading. Texts are different. We all text casually, so it's hard to tell what looks wrong, and a scammer can borrow a number that looks like someone you know. Text filtering is years behind email, and that makes it a ripe field for anyone counting on you to act before you think. Good on Verizon for publishing this. But findings like this shouldn't be buried in reports almost nobody reads, IT people included. That's part of why this section exists.

Do this: Agree on one office rule. Any text asking for a password, a payment, or gift cards gets a phone call back before anyone acts. No real boss has ever urgently needed $500 in gift cards before lunch. Call a number you already have, not the one in the text.

5. Bright Spots

One piece of good news per issue, because you get enough of the other kind.

Operation KillSwitch

This one you can sit back and read. On October 1, police in ten countries, led from Germany, took down the KillSec ransomware group. They seized five core servers, recovered at least 110 terabytes of stolen data, and replaced the group's leak site with a seizure notice. Europol links the group to about 1,000 attempted attacks. Three people have been arrested so far, including the 16-year-old believed to run it. (SecurityWeek)

Here's what I think. The headline is the arrests, but what stuck with me is how both sides worked. My guess, from 25 years in IT, is that most of that crew never met face to face. They worked in separate cells, each finding what they needed alone, hidden in plain sight. That's what kept them hard to catch. The people who caught them worked across ten countries and probably never met either. The difference is that they shared what they knew. Same internet, same distance. The team that talked to each other won.

6. One ask

What's the one app you'd most like to stop opening?

Hit reply. The name is enough. The reason is better. I read them myself, and in the next issue I'll share what you said.

Thank you for reading. See you in two weeks.

Sources

1. FBI and U.S. Secret Service, Joint Cybersecurity Advisory JCSA-20261006-01, October 6, 2026.
2. Cloud Security Alliance, research note on FortiBleed network infrastructure credential harvesting, June 25, 2026.
3. ChangePilot, October 2026 Microsoft 365 updates.
4. Verizon, 2026 Data Breach Investigations Report.
5. SecurityWeek, Police Shut Down KillSec Ransomware, October 1, 2026.