Affix Center Insights

Mainstream support for Windows 10 ended on 14 October 2025. Businesses that signed up for Extended Security Updates (ESU) got one more year of security patches, and that first year runs out on 13 October 2026. If your office still has Windows 10 machines, now is the time to decide what happens to each one. Why ESU gets expensive quickly Under Microsoft's commercial ESU terms, the price per device doubles every year: Year 1: USD 61 per device Year 2: USD 122 per device Year 3: USD 244 per device (coverage can run until October 2028) If you join late, you pay for the earlier years too. For 50 PCs, Year 2 alone is USD 6,100, and a latecomer pays USD 9,150 for Years 1 and 2 together. ESU also only covers security fixes, and PCs must be on Windows 10 version 22H2. A calmer way to handle it Make a list of every PC, including reception desks and CCTV stations that are easy to forget. Sort machines into three groups: upgrade now, fix firmware first, or replace. Buy ESU only for mach...

Many offices assume that because Microsoft 365 rarely goes down, their mail and files are safe. But a system that stays online is not the same as a system you can restore from. Microsoft looks after the platform: its data centres, hardware and uptime. Your data, your user accounts and who can access them are still your job. Where the built-in safety net ends The recovery features inside Microsoft 365 are useful, but they have short time limits: SharePoint and OneDrive recycle bins keep deleted items for 93 days in total. Exchange Online keeps recoverable deleted email for 14 days by default, and admins can raise that to 30 days. A removed user's OneDrive stays for 30 days, then sits in the recycle bin for 93 days. Retention policies are built for compliance, so rolling a whole mailbox back to a date is slow. There is also one bigger risk: if an attacker takes over an admin account, they can reach both your data and the settings that protect it. A short plan to close the gap L...

Picture a cold room compressor that trips at 2 am. The temperature rises slowly all night, and by morning the vaccines, insulin or frozen food inside may be damaged while still looking fine. A handwritten log will only show the problem after the harm is done. Why paper logs leave gaps Readings are taken only 2 or 3 times a day, so nights and weekends go unwatched. There are no live alerts, only records made after the fact. Handwritten logs carry little weight in audits and insurance claims. Nothing is recorded while goods are in transit. What an IoT setup looks like Wireless sensors sit in freezers, cold rooms and vehicles. They connect over Wi-Fi, GSM/4G, LoRaWAN or Bluetooth, send readings to a dashboard with live and past data, and raise alerts by SMS, email or app. Pharma distributors, hospitals, diagnostic labs, food processors, cold storage operators and government health departments all have a use for it. The guide also lists common rollout mistakes, such as alerts reaching...

Many business websites lose enquiries before a visitor reads a single line of the offer. The page loads slowly, buttons lag, or the layout jumps just as someone tries to tap. Google measures these problems with three numbers called Core Web Vitals, and they are worth checking if your site brings in leads. The three numbers and their targets Largest Contentful Paint (LCP): how fast the main content shows up. Aim for 2.5 seconds or less. Interaction to Next Paint (INP): how quickly the page reacts when someone clicks or taps. Aim for 200 milliseconds or less. INP replaced First Input Delay in March 2024. Cumulative Layout Shift (CLS): how much the layout moves while loading. Aim for 0.1 or less. Scores are based on the 75th percentile of real visits, so a fast office laptop does not tell the full story. Many Indian visitors use mid-range phones on changing networks. Where the slowdown usually comes from Large images that were never resized Too many third-party scripts Heavy the...

Many Indian firms still run their stock on spreadsheets, late accounting entries or someone's memory. The result is familiar: fast-moving items run out, slow items sit for months, and expired goods show up only at audit time. Six warning signs Frequent stockouts while other items do not move Physical stock does not match the books Sales staff call the warehouse before confirming an order No view of stock across branches or channel partners Expired or damaged goods found only during audits Month-end closing slowed down by stock valuation If three or more of these sound like your business, dedicated inventory software usually pays back quickly. What to look for, and how to roll it out Look for real-time stock by item, warehouse and bin, barcode or QR scanning, reorder alerts, batch and expiry tracking, and Indian needs such as HSN codes, GST-ready invoices and e-way bill support. Then keep the rollout practical: Clean the item master before go-live Do a full physical count a...

Most small offices do not lose data in a fire or flood. They lose it to a failed disk, a stolen laptop, a file deleted by mistake or a malware attack. The good news is that a sensible backup setup is not hard to build, as long as you plan what to protect and test that you can get it back. Start with what matters List the data your business cannot work without, then decide for each one how much data you can afford to lose and how fast you need it back: Accounting and GST records Shared folders on a server or NAS Email and cloud documents Files saved on laptops and desktops Website databases, CRM and network device settings Follow the 3-2-1 rule, then add one more layer Keep three copies of your data on two kinds of storage, with one copy away from the office. Add an immutable or offline copy so ransomware or an admin mistake cannot wipe everything. A common mix is a NAS for quick local restores, cloud backup for the offsite copy, and a separate backup for Microsoft 365 or Google W...

A basic router filters traffic by IP address and port, and that is about it. A next generation firewall (NGFW) looks deeper. It can identify applications, block intrusion attempts, filter websites and DNS, scan files for malware, apply rules by user and inspect encrypted traffic. For a small office that uses cloud apps, has staff working from home or stores customer data, that extra visibility matters. The sizing trap Vendor datasheets usually quote throughput with the security features switched off. Once intrusion prevention, application control, malware scanning and SSL inspection are on, real throughput is only a fraction of that number. Size the firewall for your current bandwidth plus three to five years of growth, leave headroom, and look at the threat protection figure rather than the raw firewall figure. Questions to ask before you buy What is the throughput with all security features turned on? Which features stop working without an active subscription? How long will the model...

Many companies with branch offices in India are stuck between two choices: costly leased lines or MPLS, or cheap broadband with VPNs that break too often. SD-WAN sits in the middle. Each branch gets an appliance that uses several internet or private links at the same time, and the whole network is managed from one central controller. It watches latency, jitter and packet loss, and moves traffic to the better link before users notice a problem. Signs SD-WAN is worth it You have five or more branches and plan to open more. Much of your work now runs on SaaS and cloud apps. A branch outage directly hurts sales or service. Your IT team spends too much time managing routers and VPNs. You want the same security rules at every location. If you have only two or three offices with stable links and mostly on-premises apps, you may not need it yet. Tips for a safe rollout Use links from different providers, so one fault does not take down both. In areas with weak fixed lines, a tested 4G or 5G co...

India's four Labour Codes, effective from 21 November 2025 with central rules notified on 8 May 2026, replace 29 older labour laws. For HR and finance teams, the biggest impact lands in payroll. Here is a quick overview of what your HRMS needs to handle. The five changes that matter most The 50% wage rule. If allowances excluded from "wages" (such as HRA and conveyance) exceed 50% of total pay, the excess counts as wages. This affects PF and other contributions. Gratuity for fixed-term staff. Fixed-term employees now qualify after one year. Final settlement in two working days. Exit workflows must calculate and pay final dues quickly. Working hours and overtime. A 48-hour normal week, with overtime paid at twice the ordinary rate. State-specific rules. Professional tax and labour welfare fund rules vary by state, so multi-state teams need location-based settings. The Codes also favour electronic registers with time-stamped audit trails, so manual spreadsheets b...

An MVP is the smallest version of your product that tests your riskiest assumption with real users. It is not a prototype, and it is not a low-quality product. It simply has fewer features. Here is the short version of how to build one without wasting months. The five steps Find the riskiest assumption. Talk to 15 to 20 target users before writing any code. Cut scope hard. Map one core user journey. Sort everything else into "must have", "can do manually for now" and "later". Pick simple technology. Start with a web app or PWA, use managed services, and design for mid-range Android phones and patchy networks. Build in two-week cycles. Demo every week and add analytics from day one. Launch small and measure. A few dozen pilot users, one city or one segment. Track task completion, week-2 and week-4 retention, and willingness to pay. Common mistakes Building to impress investors instead of testing with users, skipping research, adding features afte...

A once-a-year slide deck and a quiz will not stop your team from clicking a fake GST refund link. People forget quickly, the examples rarely match real Indian scams, and completion certificates say nothing about how people behave. Here is a short summary of a better approach. What changes behaviour Short and regular: five to ten minute lessons every month or quarter, one idea at a time Local examples: fake electricity disconnection notices, tax refunds, vendor bank-change requests, and senior leaders impersonated on WhatsApp Your team's languages: Hindi and Marathi alongside English Role-based: payment fraud for finance, malware CVs for HR, impersonation for leaders Make reporting easier than hiding A one-click "Report Phishing" button, a quick thank-you for every report, and a clear message that nobody gets punished for clicking. The goal is fewer clicks and more reports over time. Back it up with technology Multi-factor authentication, SPF, DKIM and DMARC for e...

The Digital Personal Data Protection Rules, 2025 do not switch on all at once. They come in phases, which gives businesses time, but only if they start now. Here is a short overview of the timeline and where to begin. The timeline in three steps November 2025: definitions and Data Protection Board provisions took effect November 2026: registration and Consent Manager obligations begin May 2027: core duties on data fiduciaries apply, including notice, consent, security, breach reporting, retention and user rights Five areas to work on Know your data. List every system that holds personal data: ERP, CRM, HRMS, email, apps, CCTV and backups. Fix notice and consent. Plain-language notices, clear opt-in (no pre-ticked boxes) and an easy way to withdraw consent. Secure it and plan for breaches. Access controls, audit logs kept for a year, and a breach playbook built around the 72-hour report to the Board. Handle rights and retention. Let people access, correct and erase their ...

Most Indian organisations know that CERT-In wants cyber incidents reported quickly. Far fewer have checked whether they could actually do it within six hours, at 2 AM on a Sunday, with the right logs in hand. This post is a short overview. The full checklist is on the Affix Center blog. What the rule asks for, in brief The CERT-In directions of 28 April 2022, issued under Section 70B(6) of the IT Act, 2000, apply to service providers, intermediaries, data centres, body corporates and government organisations. The core duties are: Report specified cyber incidents within six hours of noticing them Keep logs for 180 days , stored within India Sync system clocks with NIC or NPL time servers Name a point of contact for CERT-In Why six hours is harder than it sounds In practice, teams miss the deadline for three reasons: nobody is sure who can approve the report, the logs needed to understand the incident were never switched on or have already been overwritten, and device cloc...