What Seniors Actually Got in the Latest Tax Bill

4 min read

What Seniors Actually Got in the Latest Tax Bill, SS CreditCampaign messaging would have you believe retirees just scored a major victory. The talking point is everywhere: Social Security benefits are now tax-free. But anyone who reads the One Big Beautiful Bill Act will discover something different. The legislation contains nothing that removes Social Security from federal taxation. Zero provisions. The tax structure that has applied to benefits for over four decades remains fully intact.

So, what did pass? A new deduction aimed at older Americans. And through some rhetorical gymnastics, that deduction is being sold as something it fundamentally is not.

A Deduction Is Not an Exemption

The OBBBA creates an additional deduction exclusively for seniors. Single filers get $6,000 while married couples receive $12,000. This stacks on top of what they already claim through the standard deduction, lowering their overall taxable income.

For retirees whose financial situation falls in a particular range, this extra write-off might be enough to cancel out whatever portion of their Social Security would normally face taxation. But here’s the catch: the deduction applies to all income equally. It doesn’t single out retirement benefits for protection. If your earnings came entirely from investments or a workplace pension, the math would work identically.

Decades of Unchanged Rules

Federal taxation of Social Security benefits dates back to 1983. President Reagan signed that change with support from both parties, making up to half of benefits taxable for seniors with higher earnings. Then in 1993, Congress and President Clinton pushed the ceiling higher. Under current rules, as much as 85 percent of benefits can count toward taxable income for upper-income retirees.

None of that changed with this bill.

The thresholds determining who pays what have remained frozen since the Clinton era. Single filers earning under $25,000 and couples under $32,000 owe nothing on their benefits. Those in the middle tier face taxes on up to half. And couples bringing in more than $44,000 can see 85 percent of their Social Security added to their taxable total.

Because these cutoffs have never adjusted for inflation, more retirees get pulled into taxable categories every single year. The OBBBA leaves this problem completely unaddressed.

Looking at the Administration’s Own Math

Treasury Department calculations highlighted by the White House reveal how limited the benefit truly is. Picture a single retiree receiving $40,000 annually from Social Security alongside another $40,000 from retirement accounts like an IRA or 401(k). Current law would put their 2026 tax bill at $7,190. Under the new legislation, the amount drops to $5,685, a reduction of roughly $1,500. The senior deduction accounts for approximately $900 of those savings.

Helpful? Sure. But this person still owes thousands in federal taxes. Their Social Security benefits remain part of the calculation. The deduction simply chips away at overall liability without treating retirement benefits any differently than other income sources.

Temporary Relief with Built-In Limits

Unlike corporate tax provisions and cuts benefiting wealthy taxpayers, which received permanent status in the bill, the senior deduction disappears after 2028. It was written with an expiration date from the start.

Income limits further narrow who benefits. Single filers with earnings above $75,000 and married couples exceeding $150,000 see the deduction phase-out entirely. Ironically, these higher-earning retirees facing the steepest Social Security taxation are exactly the ones shut out from this supposed fix.

Conclusion and Why This Framing Succeeds

Announcing a supplemental deduction for older taxpayers generates little excitement. Declaring that Social Security taxation has ended makes waves. Political strategists understand that most people absorb information through headlines rather than legislative analysis. Few voters examine IRS guidance or compare statutory language.

The outcome is clever stagecraft masquerading as meaningful reform. Benefits remain taxable under the same formulas established decades ago. Inflation continues to drag more retirees across taxation thresholds, and this temporary, income-restricted deduction is merely wrapped in revolutionary packaging.

Improving Military Benefits, Relaxing Energy Regulations and Increasing Aviation Regulations

3 min read

Improving Military BenefitsVeterans’ Compensation Cost-of-Living Adjustment Act of 2025 (S 2392) – This Act was introduced by Sen. Jerry Moran (R-KS) on July 23. It passed in the Senate on Nov. 9, the House on Nov. 17, and was signed into law on Nov. 25. The purpose of this bill is to increase rates of compensation for veterans with service-connected disabilities, as well as the rates of dependency and indemnity compensation for the survivors of certain disabled veterans. The rate hikes became effective on Dec. 1.

Fairness for Servicemembers and their Families Act of 2025 (HR 970) – This bipartisan Act was introduced on Feb. 4 by Rep. Marilyn Strickland (D-WA). It authorizes increases to servicemember and veteran life insurance packages in order to account for inflation and higher costs of living. It passed in the House on April 7, in the Senate on Nov. 20, and was enacted by the President on Dec. 12.

Veteran Fraud Reimbursement Act of 2025 (HR 1912) – The Veterans Benefits Administration has experienced negligence and fraud that have prevented many veterans from receiving benefits. In the past, the case-by-case system of investigation into misuse led to further delays; in some cases, veterans passed away before ever receiving remuneration. The purpose of this bill is to allow the Veterans Benefits Administration to reimburse victims of fraud via a streamlined process, so that the investigation occurs after the affected veterans have been reimbursed. The bill, which was introduced by Rep. Gerald Connolly (D-VA) on March 6, passed in the House on May 5, in the Senate on Nov. 20, and was signed into law on Dec. 12.

SPEED Act (HR 4776) – The purpose of this bipartisan legislation is to streamline the existing environmental analysis requirements for energy projects (e.g., offshore drilling, mining, pipeline development). Provisions include reducing litigation challenges to a 150-day challenge window, developing standardized federal action criteria, and defining procedural deadlines. The Act was introduced by Rep. Bruce Westerman (R-AR) on July 25 and passed in the House on Dec. 18. Its fate currently rests with the Senate.

ROTOR Act (S 2503) – Prompted by multiple incidents this year, including military aircraft such as the Washington, D.C., helicopter collision, this bipartisan bill seeks to improve aviation safety and Federal Aviation Administration (FAA) oversight. The legislation would specifically require all aircraft to incorporate ADS-B technology, which displays nearby planes and weather data on cockpit screens. The legislation was introduced by Sen. Ted Cruz (R-TX) on July 29. It passed in the Senate on Dec. 17 and awaits consideration by the House.

Lower Health Care Premiums for All Americans Act (HR 6703) – Sponsored by Rep. Mariannette Miller-Meeks (R-IA), this healthcare bill proposes expanding association health plans, increasing transparency requirements for pharmacy benefit managers, and funding some cost-sharing reductions for qualifying Health Insurance Marketplace enrollees. It does not include extending the enhanced premium tax credits that expired on Dec. 31, 2025. The bill was introduced on Dec. 15 and passed in the House on Dec. 17. Its fate now lies with the Senate.

The New Face of Phishing: Techniques, Targets and Prevention

4 min read

Phishing Attacks Phishing is a major threat that keeps evolving and has now become a sophisticated and costly cyber risk facing businesses of all sizes. Previously linked to malicious links in an email, phishing is now powered by AI, automation, and social engineering. The attacks have become harder to detect; they are faster to execute; and they can be very damaging if successful. With many business processes happening online – such as payments, approvals, and customer engagement – the attack surface has expanded, and so has the creativity of cybercriminals.

The Changing Landscape of Phishing

Modern phishing is unlike the previous suspicious and poorly written emails, and today cybercriminals are using AI tools to do many things, including:

  • Generate perfectly written and personalized messages – attackers can now easily analyze company websites, social media profiles, public reports, and employee profiles to clone the tone, style, and communication patterns. Messages appear legitimate when they reference recent projects or internal updates.
  • Generate deepfake audio and video – with readily available AI voice-cloning tools, a scammer can easily impersonate CEOs or CFOs and request urgent wire transfers or credential access.
  • Bypass MFA using real-time phishing kits – these kits mirror login screens of popular business tools such as Microsoft 365 or Google Workspace. An employee enters credentials and authentication codes into the fake page, giving attackers instant access.
  • Launch automated hyper-targeted attacks – with automation, criminals can target specific departments using tailored messages relevant to their daily tasks.

High-Value Targets Inside Organizations

Phishing attacks are no longer random but very strategic:

  • C-Suite executives – executives are prime targets due to their authority and access levels. If an executive is compromised, their inbox can be used to authorize payments or request sensitive data.
  • Financial teams – the accounts department faces fake invoice scams, fraudulent banking instructions, and impersonated vendor messages.
  • HR departments – attackers send fake resumes loaded with malware. They might also pose as job applicants to access employee data.
  • Remote and hybrid workers – these workers use shared Wi-Fi, personal devices, and unsupervised collaboration tools. This creates a wider entry point for attackers.
  • Customers and partners – attackers impersonate brands and trick customers into submitting payments or sensitive information through fake lookalike pages.
  • IT admins and system engineers are also valuable as they have privileged access.

Modern Phishing Techniques

Emails remain the dominant delivery method, but attackers have diversified to:

  • Quishing (QR Code Phishing)
    QR codes are everywhere: on flyers, delivery packages, restaurant menus, conference badge,s and more. However, QR codes can lead to malicious sites or credential harvesting pages.
  • Search Engine Phishing or Malvertising
    Fake ads appear above legitimate brands on search results that a user can click on –thinking it’s a legitimate link.
  • Browser-in-the-Browser Attacks
    These are fake login pop-ups that replicate trusted login screens. An employee will enter their credentials, thinking it’s a legitimate site, and this goes straight to attackers.
  • OAuth Application Scams
    Here, attackers don’t steal passwords. Instead, they trick users into granting access to a malicious app. Once the access is granted, the attacker has total access.
  • Deepfake Calls and Video Messages
    These may come as high-pressure video calls or messages from an executive requesting urgent action, emergency payment, or private documents.
  • Fake Travel and Expense Scams
    Taking advantage of corporate travel, attackers clone legit travel sites in order to steal credit card and employee information.

Prevention Strategies Every Business Must Adopt

Phishing is a problem that can’t be eliminated but can only be significantly reduced through a combination of technical measures and human risk management.

Prevention requires a combination of technology, processes, and people.

  1. Build a Security-Aware Culture
    Training must be continuous, engaging, and realistic. It should be conducted via simulation and scenario-based learning.
  2. Strengthen Email Authentication
    Implement modern AI-based email filtering tools to help detect anomalies that human eyes miss. Include identity verification protocols like DMARC, SPF, and DKIM to reduce spoofing attacks.
  3. Adopt Zero Trust Security
    Implement the “never trust, always verify” approach. Access should be limited, monitored, and timed out automatically. High-risk actions should trigger additional verification.
  4. Secure Remote Work
    Implement VPNs, approved devices, endpoint protection, encrypted storage, and clear policies.
  5. Implement Multistep Verification for Financial Transactions
    Require verbal confirmation or dual approvals for high-value transfers.
  6. Monitor Vendors and Partners
    Keep in mind, there is a sharp rise in supply-chain attacks. Regularly verify domains, emails, and communication from suppliers and partners.
  7. Have an Incident Response Plan
    Be ready with a response plan in case of a breach. Acting quickly will reduce potential losses.

Conclusion

Phishing has transitioned into a sophisticated threat targeting the core operations of a business. New phishing variants reveal how attackers continually evolve their techniques. With the right awareness, technology, and processes, organizations can significantly reduce exposure.

Long Term Care Insurance Options

5 min read

What is Long Term Care Insurance?In 2024, the median household income in the United States was $83,730. However, the national average annual cost of 24-hour paid long-term care (LTC) for a retiree age 65 and older was more than $125,000, according to the Department of Health and Human Services. Moreover, one in five seniors will require care for more than five years.

Obviously, the math varies by household, but the reality is that the majority of older Americans who rely on paid caregiving will use much of their retirement savings and investments to pay for it. When considering insurance, there are presently two options: Long Term Care Insurance (LTCi) and Hybrid Life Insurance with an LTC component. Be aware that each policy offers a throng of variations and exclusions, so it is important to dig into the details of individual policies before making a decision.

Long Term Care Insurance

Purchasing a long-term care insurance policy can help offset the cost of caregiving for either in-home care (in some cases, even payouts for family caregivers) or care outside the home (e.g., adult daycare services, assisted living, memory care, nursing home). However, it’s important to understand the following about LTCi.

It can be quite expensive.

Premiums can range from $2,000 a year for a man in his 50s to more than $12,000 a year for a woman in her 70s. Furthermore, premiums increase annually until benefits begin (premiums cease while benefits are paid).

It may not cover the full cost of care.

Unless care is needed for only a few hours a day, long-term care policies generally do not cover the full cost of paid caregiving. For example, let’s say a policy pays $150 a day, but the owner needs care for eight hours a day. His in-home caregiver charges $30 an hour. That means his cost is $240 a day, so he’ll have to pay the additional $90 a day out of his own pocket. That’s

up to $2,790 a month or $32,850 a year. So, while LTCi can help defray the cost, someone who needs extensive care must have other assets to cover the rest of the cost. For an elderly person who needs 24-hour home care, the cost can be exponential.

Many new policies cover only a handful of years.

When you purchase an LTCi policy, you choose from various options that increase or decrease your premium. For example, coverage periods may range from two years to five years to life. You may also select a waiting period before coverage begins after purchase, which could range from 30 days to 365 days. The longer the wait period, the lower the premium. If you have an immediate need for coverage, you might be denied coverage altogether. That is why it’s best to purchase coverage when you are younger (50s) and presumably healthy.

You don’t get to choose when to start benefits.

LTCi coverage doesn’t kick in until you qualify, which generally means you are no longer able to independently conduct some or all of the prescribed daily living activities. The five primary qualifiers are bathing, going to the toilet, dressing yourself, feeding yourself, and the ability to move from bed to chair/wheelchair. Qualification to begin taking LTCi benefits usually requires physician verification.

The downside of a standalone LTCi policy is that it is a “use-it-or-lose-it” type of contract, much like auto or homeowner’s insurance. In other words, you may pay for it for decades but never actually use it, so all the premiums paid are lost.

Hybrid Life/Long Term Care Insurance

On the other hand, a hybrid insurance policy will pay out some portion of unused proceeds to beneficiaries upon the death of the policyowner. A hybrid policy is basically a life insurance policy with an LTCi rider or an accelerated benefit clause, which, either way, means it will cost more.

First and foremost, it works just like life insurance – once the owner passes away, the beneficiary receives a payout. However, if the owner needs money to pay for long-term care while he is still alive, he can tap the rider or life insurance payout to pay for the care. Then, when he passes away, his heirs receive any amount of the unused proceeds. With this type of policy, the owner doesn’t pay for LTCi coverage he does not need, but it’s available if he does need it.

Premiums for a hybrid policy, like any life insurance, depend on the age, gender, health, and amount of insurance proceeds desired, as well as any additional charge for the LTCi rider. Some policies include LTC benefits as a standard feature.

Employer-Sponsored Benefit

If your employer offers long-term care insurance as a voluntary benefit, it’s worth considering because group rates are generally cheaper than on the individual market. However, while employer-sponsored LTCi policies are usually portable – meaning you can keep paying for it after you leave your employer – your premiums may increase when no longer part of the group policy.

As always, reach out to a professional when it comes to planning for you and your family’s future care.

Partial Government Funding, Promoting Transparency and Protecting Against Foreign Terrorism

3 min read

Government Promoting TransparencyEpstein Files Transparency Act (HR 4405) – The purpose of this bill is to require the Department of Justice to release all documents and records in its possession of investigations and court cases related to Jeffrey Epstein. Epstein was previously convicted of soliciting prostitution from an underage girl, and also faced new sex trafficking charges prior to his 2019 death in custody. The files are expected to reveal the names of other people involved in the sex trafficking scheme. The act was initially introduced by Rep. Ro Khanna (D-CA) on July 15. It was updated and passed in the House on Nov. 18, in the Senate the next day, with only one opposing vote between the two chambers. The bill was signed into law by the president on Nov. 19. The DOJ has up to 30 days to release the documents, which may be lightly redacted to protect against unwarranted invasion of privacy, such as victim names and medical data.

Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act, 2026 (HR 5371) – This is the bill that ended the federal government shutdown. It includes funding for the remainder of the fiscal year for the food assistance program SNAP, the Department of Agriculture, the FDA, the military, Veterans Affairs, and Congress through Sept. 30, 2026. However, it stops short of funding approval beyond Jan. 30, 2026, for Commerce, Justice and Science (CJS); Defense, Energy and Water; Financial Services and General Government (FSGG); Homeland Security; Interior, Environment, and Related Agencies; Labor, Health and Human Services, and Education (LHHS); State, Foreign Operations and Related Programs; Transportation; and Housing and Urban Development. The continuing resolution did contain a few ancillary provisions, including mandatory backpay and rehiring of all federal employees furloughed or laid off during the shutdown. The original version of the bill was introduced on Sept. 16 by Rep. Tom Cole (R-OK). It passed in the House on Sept. 19 and failed in the Senate 14 times before a revised bill was passed on Nov. 10. The final bill, with changes, passed in the House on Nov. 12 and was signed into law on the same day.

District of Columbia Cash Bail Reform Act of 2025 (HR 5214) – This bill was introduced on Sept. 8 by Rep. Elise Stefanik (R-NY). It represents Republicans’ ongoing battle over who has jurisdiction over Washington, D.C.’s law enforcement and justice system. The bill would return to a cash bail system and require automatic detention of those charged under a wider set of offenses. The new confinement rule counters D.C.’s long-standing system of judge discretion regarding detention or supervised release. The bill passed in the House on Nov. 19 and currently lies in the Senate.

Strengthening Cyber Resilience Against State-Sponsored Threats Act (HR 2659) – This bipartisan legislation represents a federal strategy to strengthen U.S. cyber defenses to counter China’s attempts to actively target American infrastructure. Unfortunately, the bill does not apply to other hostile state-sponsored cyber actors such as Russia, Iran, or North Korea. Introduced by Rep. Andrew Ogles (R-TN) on April 7, the bill passed in the House on Nov. 17 and currently rests with the Senate.

Department of Homeland Security Vehicular Terrorism Prevention and Mitigation Act of 2025 (HR 1608) – This bipartisan bill seeks to address the rising threat of vehicle-based attacks, including the possible misuse of autonomous vehicles, rideshare platforms, and connected vehicle technologies. The legislation was introduced by Rep. Carlos Gimenez (R-FL) on Feb. 26 and passed in the House on Nov. 17. It currently awaits consideration by the Senate.

New Rules for Inherited Traditional IRA Distributions

3 min read

Inherited Traditional IRA DistributionsThe rules for IRAs inherited after 2020 changed when Congress passed the Secure Act in 2019. The new rules eliminated the opportunity for non-spousal beneficiaries to “stretch” inherited IRA earnings over their own lifetime. Up until this year, required minimum distributions (RMDs) and associated penalties were waived while the IRS clarified the new rules; but in 2025, they are in full force for most inherited IRA beneficiaries.

For clarity: Non-spouses who inherited IRA assets after 2020 MUST take RMDs starting this year.

RMD Rules For Non-Spouses

For Traditional IRAs inherited after 2020, the first thing a non-spousal beneficiary must do is transfer the inherited assets into an inherited IRA under his own name. Note that RMDs are then required only if the original owner had reached their RMD age before dying. Under this scenario, the beneficiary must take required minimum distributions going forward, including any RMD not taken in the year the original IRA owner died. Over the next nine years, the new inherited IRA owner must take annual RMDs based on his own life expectancy and deplete the account within 10 years of the decedent’s death.

However, if the original account owner was NOT required to take minimum distributions as of the time he passed, the inherited IRA beneficiary is NOT required to take them – unless he reaches RMD age during the 10-year holding period(starting at age 73, or age 75 effective 2033). Either way, he still must empty the account and pay the requisite tax bill within 10 years of the original account owner’s death.

In addition to paying taxes owed on RMDs, inherited account owners are subject to a 25 percent penalty on any amount shy of that year’s required distribution. Should you miss an RMD, you may be able to reduce the penalty to 10 percent if the correct distribution is taken within two years.

RMD Rules For Spouse Beneficiaries

A spousal beneficiary of the original IRA owner has more options than a non-spouse. For starters, she can retain the original account under her own name. Similar to the non-spouse beneficiary, if the decedent spouse HAD reached his RMD age, the surviving spouse must take required minimum distributions as well, including any RMD not taken in the year the original owner died. However, RMDs thereafter will be calculated based on the surviving spouse’s life expectancy, and there is no requirement to deplete the account within 10 years.

If the original IRA owner had?NOT?started taking RMDs, then the spouse does not have to take RMDs until she reaches the age required to do so. At that point, the RMDs will be based on her own life expectancy.

A spousal beneficiary also has the option to transfer the inherited assets into her own IRA. Under this scenario, her RMD schedule is based on her own age. This option allows her to delay taking RMDs until she reaches RMD age, regardless of the RMD status of the deceased spouse. This strategy provides the opportunity for the inherited assets to grow longer, tax-deferred.

For clarity: the 10-year rule for full distribution does not apply to spouses.

Note that the rules discussed herein do not apply to Traditional IRAs inherited by Trusts or “Eligible Designated Beneficiaries” (EDBs), which refer to chronically ill or disabled beneficiaries, beneficiaries who are younger than the deceased account owner by 10 years or less, or minor children of the account owner.

It’s best to work with a financial advisor or IRA account custodian to choose the option best suited to your circumstances – and ensure you adhere to the appropriate rules.

Controversial Defense Funding Bill, Shoring Up ESOP Plans, and Leave Benefits for Public Health Personnel

3 min read

Shoring Up ESOP PlansNational Defense Authorization Act for Fiscal Year 2026 (S 2296) – Introduced by Sen. Roger Wicker (R-MS) on July 15, the Senate passed this legislation on Oct. 9. The bill is a carve-out of the 2026 budget bill intended to fund military appropriations for the 2025-2026 fiscal year. The bill was largely supported by Republicans but less so by Democrats, who are in favor of keeping the government closed until all of their budget concerns are addressed. In addition to establishing funding and policies for military and defense-related activities, the bill includes a roadmap for bomber modernization, a real-time database for contractor compliance oversight, and authorizing programs for nuclear weapons facilities. The legislation would authorize $32.1 billion over the President’s budget request, and the White House opposes provisions in the bill that thwart the President’s ability to control immigration and conduct foreign affairs, including submitting plans to Congress ahead of actions, dictating the terms of intelligence support to Ukraine, and enabling the Defense Department to bypass the Administration’s tariffs. The bill currently rests with the House, which asserts it will not return to regular session until the Senate passes the current controversial CR budget bill.

Employee Ownership Representation Act of 2025 (S 1728) – This bipartisan bill seeks to expand the membership of the Advisory Council on Employee Welfare and Pension Benefit Plans to include two representatives of employee ownership organizations. While the council presently includes 15 members from business, labor, and the public, the council has no expertise specific to Employee Stock Ownership Plans (ESOPs). The legislation was introduced by Sen. Bill Cassidy (R-LA) on May 13 and passed in the Senate on Oct. 9. It currently awaits consideration by the House.

Retire Through Ownership Act (S 2403) – The main purpose of this bill is to provide a clear definition for certain closely held stock that aligns valuations with IRS standards in an effort to mitigate valuation risk for ESOPs. It would also provide “safe harbor” for trustees relying on these guidelines. The Act was introduced by Sen. Roger Marshall (R-KS) on July 23. It passed in the Senate on Oct. 9 and currently lies with the House.

Uniformed Services Leave Parity Act (S 1440) – Introduced by Sen. Tammy Duckworth (D-IL) on April 10, this legislation would authorize leave benefits (parental leave, emergency leave) to Public Health Service (PHS) officers. The bill sponsors assert that the current lack of these important benefits is a challenge to recruiting and retaining PHS personnel, who should be on par with the same benefits offered to uniformed service members. The bill passed in the Senate on Oct. 9 and is up for review in the House.

Internal Revenue Service Math and Taxpayer Help Act (HR 998) – This bill was introduced on Feb. 5 by Rep. Randy Feenstra (R-IA). Among other provisions, it instructs the IRS to provide taxpayers with details of notices that relate to a math or clerical error. The bill passed in the House on March 31 and in the Senate on Oct. 20. It currently awaits the President’s signature to become law.

Why Authorization Sprawl Is the Next Big Security Blind Spot and How to Fix It

4 min read

Authorization Sprawl, What is Authorization SprawlDespite major investments in cybersecurity, organizations continue to face breaches. Most security mechanisms implemented guard against threats such as password theft. However, there is a growing concern with the unchecked expansion of user access, permissions, and tokens across apps, clouds, and systems.

This growing challenge is known as authorization sprawl, and it is becoming one of the most dangerous and least visible threats in modern enterprise security.

According to insights from the SANS keynote at the RSAC 2025 Conference, attackers are increasingly exploiting this sprawl to gain legitimate, persistent access that bypasses multifactor authentication (MFA), security information and event management (SIEM) alerts, and endpoint detection and response (EDR) visibility altogether.

What is Authorization Sprawl?

Authorization sprawl occurs when access permissions multiply uncontrollably across systems, users, and applications. Every time a team or department adds a new SaaS integration, service account, or API key, another layer of permission is introduced.

In an attempt to make access to multiple applications easy, users also have single sign-on (SSO), designed to help log in once and access multiple applications securely. Here, users are granted access to several connected systems through SSO, adding to the authorization sprawl problem.

Over time, all these factors create a complex ecosystem that even security teams have a hard time tracing who can access what.

Unlike authentication, which verifies who someone is, authorization determines what one can do. When permissions expand without review, attackers take advantage of forgotten tokens, dormant accounts, or outdated roles to move freely inside systems.

Why Traditional Defenses Miss It

Most defenses focus on identity verification, such as MFA, conditional access, and endpoint protection. But once a user is authenticated, there is no monitoring. This is the blind spot that attackers exploit. Instead of breaking in, they log in using legitimate session tokens, application programming interface (API) keys, or open authorization (OAuth) grants.

The misuse of valid credentials or access tokens enables cloud-related breaches. These attacks bypass traditional detection tools because they appear to be normal activity by authorized users.

A recent incident involving Salesloft’s Drift application highlights how damaging authorization sprawl can be. Drift, an AI chatbot often integrated with Salesforce, was exploited after attackers gained access to Salesloft’s GitHub account and later its AWS environment. From there, they stole OAuth tokens and authentication credentials, exposing Salesforce data from potentially hundreds of organizations. This incident is an example of how interconnected SaaS systems and unchecked authorization links can create a cascading breach effect, where one weak point leads to multiple breaches across services.

The Business Impact of Authorization Sprawl

Aside from increasing technical risk, authorization sprawl erodes compliance, governance, and trust.

  1. Regulatory Exposure – Frameworks like GDPR, SOC 2, and HIPAA require strict access control and auditability. Untracked permissions make demonstrating compliance nearly impossible.
  2. Operational Risk – An overprivileged account can unintentionally leak data, delete configurations, or expose APIs.
  3. False Sense of Security – Zero Trust frameworks often stop at identity verification. Failing to continuously validate authorization is equivalent to protecting the front door while leaving internal doors wide open.

How to Fix Authorization Sprawl

Luckily, solving this problem does not require removing existing security controls but rather extending visibility and discipline into authorization.

  1. Conduct Regular Access Audits – Map users, roles, and permissions across your environment. Be sure to look for redundant privileges, dormant accounts, and orphaned API keys. Use tools that help visualize hidden paths and privilege escalation routes.
  2. Implement Structured Access Control – Use frameworks like role-based access control (RBAC) or attribute-based access control (ABAC). Standardizing roles ensures fewer exceptions and easier auditing.
  3. Automate Reviews and Revocations – Integrate identity and access management (IAM) with HR systems so access automatically changes when employees leave or change roles. This helps eliminate the temporary access that never gets removed.
  4. Shorten Token Lifetimes and Rotate Credentials – Session tokens and personal access tokens (PATs) should have an expiration period, such as 30 to 90 days. Using automated key rotation policies will help prevent long-lived access tokens from becoming backdoors.
  5. Enforce the Principle of Least Privilege – Grant users and systems only the minimum access needed.
  6. Extend Zero Trust to Authorization – Verification shouldn’t end with login. Apply continuous authorization checks.

Conclusion

As cloud ecosystems, APIs, and integrations continue to multiply, authorization complexity will grow exponentially. Businesses that invest in mapping and controlling authorization sprawl will stay ahead of both attackers and regulators. In cybersecurity, visibility equals control, and this begins with knowing exactly who can do what.

Ideas for Small Business Succession Planning

4 min read

Small Business Succession PlanningIt can be hard to build up your own business, but it can be harder to sell it for what it’s worth. In fact, only around three in 10 family-owned businesses survive for the next generation. Whether family-owned or in a partnership of non-family owners, business succession is no easy feat.

Succession Planning

It is very important to have a succession plan, even if the business is fairly new. That’s because it gives heirs a roadmap for what to do if the owner dies unexpectedly. The first step is to figure out who you want to run the business after you. If you want to pass it on to one or more family members, be sure to ask if they’d like to own it. Note that the family route may need to be considered a year or more before the transfer to ensure the successive owner has time to learn the ropes.

If you decide to sell the business to a third party, consider if you want to sell it outright or retain partial ownership and continue to get a share of the profits. Also, think about whether or not you want to participate in running the business once ownership changes hands.

Business Owner Partners

In the case of a shared business, a succession plan can help clarify the intent of both owners and provide a legal path of succession if one owner dies. In a worst-case scenario, instead of the surviving partner taking the reins to run the business on his own, he may end up having to run it alongside the deceased owner’s spouse, who might not possess the skills, experience, or proclivity for the business. Or maybe the surviving spouse decides not to sell the business but receive a share of the profits without doing any work.

Key Man Insurance

If the surviving owner would simply like to buy out the deceased owner’s interest in the business, there are certain financial strategies available in the event he doesn’t have the assets to do so. One vehicle is called key man insurance, which refers to policies paid for by the business to cover the death of the business owner. Death proceeds are specifically earmarked to keep the business operating upon the death of the owner.

Buy-Sell Agreement with Life Insurance

A succession plan that includes a Buy-Sell Agreement contract specifies what will happen to the business shares of the owner upon his death. In most cases, the surviving business partner will use the life insurance proceeds to buy the shares at a predetermined value, which ensures that the deceased’s family is adequately paid for his share of the business upon his death.

Family-Owned Business

In the case of a family-owned business, a family member who is active in the business may take out an insurance policy on the owner and use the proceeds to buy out the interests of the non-active family members after the owner dies.

Private Annuity

Another option is a private annuity, in which the owner sells his business to his children in exchange for a fixed annuity income, based on IRS interest rates, for the rest of the owner’s life and, if elected, that of his spouse. If the owner outlives his life expectancy, the children may end up paying him more than the business is worth. However, if the owner dies sooner, they may pay less than the business is worth.

Family Limited Partnership

With a family limited partnership, the business owner transfers some or all of his business to individual family members while he is alive. When the owner dies, the portion of the business that has been transferred is no longer considered a part of the owner’s estate and is therefore not subject to estate taxes.

Seller Financing

If the owner has trouble selling the business to a third party, including perhaps a valuable employee who would like to take over, consider a seller financing agreement. Instead of paying the owner a lump sum, the buyer pays him a fixed, regular payment over a set number of years. Future business revenue secures the note, and the current owner would be qualified to know how well business revenues might hold up under the new ownership. Some sellers set up a finance agreement for just five years or so, after which time the buyer is expected to qualify to refinance with a conventional loan. It’s also possible for the financier to sell the new owner’s note if he decides down the road to get out of the financing role. The good news is that, should the buyer default on the loan, the seller would still own the company.

Enhancing Homebuyer Protections, Wildfire Risks, 911 Response and Domestic Manufacturing

3 min read

HR 2808, HR 2483, HR 3400, S 306, S 725, S 433Homebuyers Privacy Protection Act (HR 2808) – Introduced by Rep. John Rose (R-TN) on April 10, the House passed this bill on June 23, and the Senate passed it on Aug. 2. Signed into law on Sept. 5, this bipartisan bill prohibits a consumer reporting agency from selling a mortgage applicant’s personal information to other lenders without their explicit consent. The legislation is designed to safeguard homebuyers’ personal financial information and eliminate the frequent bombardment of other lender marketing offers during the financing process underway with the applicant’s existing lender.

SUPPORT for Patients and Communities Reauthorization Act of 2025 (HR 2483) – This bill renews billions of dollars in federal funding for programs responsible for preventing overdoses and further strengthening treatment and recovery services. The renewal of funds to nationwide county programs is timely, given the current behavioral health and substance abuse disorder crises. The bill was introduced by Rep. Brett Guthrie (R-KY) on March 31, passed in the House on June 4 and in the Senate on Sept. 18; it currently awaits signature by the president.

TRAVEL Act of 2025 (HR 3400) – Also known as the Territorial Response and Access to Veterans’ Essential Lifecare Act, the purpose of this bill is to enable VA physicians and specialists to travel to hard-to-reach areas in U.S. territories for up to one year. The Act is designed to help fill critical gaps in VA medical services across the Pacific territories by compensating providers with travel bonuses. The legislation was introduced by Representative Kimberlyn King-Hinds (R-Northern Mariana Islands) on May 14. It passed in the House on Sept. 15 and currently lies with the Senate.

Fire Ready Nation Act of 2025 (S 306) – Introduced by Sen. Maria Cantwell (D-WA) on Jan. 29, this legislation would establish a fire weather program at the National Oceanic and Atmospheric Administration (NOAA). The new program would enable scientists to better predict wildfires, fire weather, and fire risk via forecasting, detection, and modeling, as well as respond quickly to prevent devastation to families, homes, and businesses due to wildfires. The legislation was passed in the Senate on Sept. 10 and is now under review in the House.

Enhancing First Response Act (S 725) – This bill was introduced on Feb. 25 by Sen. Amy Klobuchar (D-MN) and passed in the Senate on Sept. 10. The law would reclassify 911 dispatchers as public safety workers from their current role as office and administrative support in the federal Standard Occupational Classification system. In addition, the bill contains provisions to improve access to the 911 call system during major disasters and make the system more resilient against outages and disruptions. The fate of this bipartisan bill now rests in the House.

National Manufacturing Advisory Council Act (S 433) – This Act was introduced by Sen. Gary Peters (D-MI) on Feb. 5. It seeks to establish a working group of representatives from industry, labor, and academia to advise Congress on policies and programs to enhance domestic manufacturing despite the challenges of global competition, U.S. supply chain issues, and the current tariff solution. The bipartisan legislationwas  passed unanimously in the Senate on July 14 and is currently under review in the House.