The technology exists. That's what makes the current situation frustrating.
Abnormal Security runs behavioral AI against inbound email and catches the kind of invoice spoofing that cost my client $140,000 -- not by matching known malicious signatures, but by modeling what normal communication from a specific vendor looks like and flagging deviation. The GSMA publishes a SIM Swap API that lets financial institutions and mobile carriers query in real time whether a phone number was recently ported -- infrastructure-level tooling that, if it had been live during the credential-theft incident I described in Post 1, would have blocked the MFA bypass before the account cleared. On the endpoint side, EDR platforms score device and account risk continuously and feed that signal upstream into fraud detection.
None of this is experimental. These are production tools, running in production environments, doing the thing right now.
What doesn't exist -- not yet, not as a standard offering -- is a coherent defense perimeter that extends from the financial institution all the way to the SMB endpoint where fraud actually enters. The bank's fraud team has access to transaction anomaly detection. Your business, which is the entry point, has whatever you've built.
This gap has a useful analogy in a domain where the same problem was already solved.
Cloud shared responsibility. When AWS or Azure or Google Cloud sells you compute, they publish a shared responsibility model that defines exactly where their security obligation ends and yours begins. The cloud provider secures the physical infrastructure, the hypervisor, the network fabric. You secure the operating system, the application, the data, the identities accessing it. The line is explicit, documented, and enforced in their terms of service.
Financial services doesn't have this yet for SMB clients. There's no equivalent document that says: "We defend the payment rail. You defend the endpoint. Here's what 'defend the endpoint' means in practice, and here's how we verify it." The conversation is starting -- embedded finance platforms and commercial banking APIs are beginning to build risk-scoring of their SMB client base into their fraud models -- but the explicit perimeter definition, and the operational support for businesses on the other side of it, doesn't exist at scale.
That's the practice IT CloudLink is built around.
Not in an abstract "we do cybersecurity" sense. Specifically: endpoint security for SMBs that operate in environments where financial data, client funds, or regulated records pass through their systems. Healthcare practices with patient billing tied to insurance payment rails. Law firms that handle client trust accounts. Mid-market operators processing supplier payments at a volume where a single BEC incident -- the FBI's 2025 Internet Crime Report puts the average loss at $123,000 -- would be material to the business, not just an unpleasant line item.
Here's what closes the gap at your scale, and where it differs from what the bank sees. You won't get carrier-level SIM swap detection -- that's infrastructure sitting at the phone company and the bank, not something an MSP wires into your stack. What you get instead is removing the attack surface that infrastructure exists to catch:
- No SMS-routed MFA on any account with financial access, full stop.
- Email security configured to DMARC enforcement and BEC detection at the inbox level, before the spoofed invoice reaches staff -- the same category of defense Abnormal Security runs, scaled to what an SMB actually needs.
- Endpoint detection that generates the audit trail an insurer will ask for if a claim is ever filed.
- Security awareness training calibrated to the actual social engineering patterns in the FBI IC3 data -- not generic phishing awareness, but the specific mechanics of how BEC attacks target businesses at your transaction volume.
AFP's 2026 survey number is 74% -- the share of organizations that experienced BEC in the prior year. The businesses in that 74% that had defensible controls in place recovered faster, had cleaner insurance outcomes, and in several documented cases caught the attack before the wire completed.
The entry point is your door. Closing it is a specific, achievable thing. The tools and the methodology exist; what most SMBs are missing is someone who has done this in an environment like theirs, who knows which vendor claims are real and which are marketing, and who can close the actual gap rather than sell you a compliance checkbox.
That's what we do.
If you run a law firm, a medical practice, or a business that moves money and handles sensitive data in the Los Angeles area, tell me where your business moves money, and I'll tell you specifically where the gap is. Start the conversation.