Affix Center Insights

Almost every HR software demo now has an "AI" badge somewhere. Some of it is useful. Some of it is old rule-based automation, like approval reminders and auto-calculated deductions, with a new name and a higher price. Before you pay for an AI tier, it helps to know which kind you are looking at. Three things vendors call AI Rules: workflows and reminders. They should be exact, and they are not a reason for a premium. Machine learning: spots patterns in past data, such as payroll anomalies or attendance gaps. Test it on your own data. Generative AI: answers employee questions and searches policies. It must be correct and say "I don't know" when it should. A short checklist before you sign Fix the basics first: master data, attendance, leave and payroll with PF, ESI, professional tax and TDS. Write one line for each AI feature naming the problem it solves. Drop the ones you cannot link to a problem. Test with anonymised payroll and attendance data and co...

Most offices never think about the small web server running inside their router, firewall or printer. On 28 October 2026 CERT-In gave them a reason to. Its critical advisory CIAD-2026-0057 covers several flaws in GoAhead, an embedded web server that powers the admin pages of many routers, gateways, printers and industrial controllers. What is wrong with GoAhead The problems come from weak certificate checks. The most serious one, CVE-2026-115881 (CVSS 9.1), lets a revoked client certificate still log in over mutual TLS on OpenSSL builds of GoAhead 3.4.5 to 6.1.0. CERT-In says an attacker could bypass security controls, read sensitive data or decrypt some TLS traffic. The fixed version is GoAhead 6.1.1, but you cannot install it yourself: each device maker has to ship it inside a firmware update. Where to start this week Make a list of embedded devices: routers, firewalls, VPN gateways, printers, cameras, NVRs, UPS cards and controllers, with make, model and firmware version. Ask each...

Many companies decide to build their own HRMS because no ready product fits their shifts, pay rules or integrations. The idea is sound. The trouble usually starts before the first line of code, when nobody has written the HR rules down. Five reasons custom HRMS builds stall HR policies live in people's heads, so developers guess. Payroll looks simple until statutory deductions, arrears and full-and-final settlements show up. Every module starts at once and none reaches the finish line. Master data is messy: wrong joining dates, missing bank details, duplicate employee IDs. No one from HR owns the product, so it does not match how the team works. A better order of work Get every policy documented and signed off first. Do an honest build vs buy check. Most SMEs do better with a configurable product. Clean the data, then build in phases. Run parallel payroll for at least two months. Keep statutory rates configurable and keep audit trails on salary and bank changes. Track a...

If your business sells online, files GST refunds or plans to close a registration, the next few months bring changes. Reports say CBIC Notification No. 05/2026 to Central Tax, dated 26 October 2026, amends the CGST Rules, 2017, with the first changes live from 1 November 2026 and the last ones from 1 April 2027. Who feels it first E-commerce sellers: under a new Rule 14B, eligible sellers may register in another state using the marketplace operator's warehouse as their principal place of business, subject to conditions such as a monthly output tax limit. Businesses closing a GSTIN: voluntary cancellation is reportedly due within 30 days of the triggering event. Refund filers: the officer's acknowledgement or deficiency window reportedly drops from 15 days to 10, and a revised RFD-01 form follows from 1 December 2026. What to put on your list now Read the notification with your tax adviser. Name one owner for each phase date. Review open refund claims and any planned c...

Many offices stay with an IT support vendor they are unhappy with because switching feels risky. Who knows the passwords? Which server does what? What happens to the open tickets? A planned handover removes most of that risk. Before the new vendor starts Ask for an audit of your current setup: desktops, laptops, printers, network, servers and business software. Get the findings documented so nothing lives only in one person's head. Agree how monitoring will be switched on and who gets alerts. Fix a single helpdesk route for all IT issues from day one. What to check in the AMC contract Scope: which hardware, networking, servers and software are covered for the fixed yearly fee. Response times: written into the contract, not promised on a call. Spare parts: whether replacements are included or quoted separately. Preventive visits: how often they happen and what they check. Escalation: how an incident is logged, prioritised and escalated, and how you see the resolution ...

Many ERP projects end with the same line: the software was bought, but the solution never arrived. A working ERP solution is the software plus process design, configuration, data migration, integrations, training and ongoing support. If you only compare licences, you are comparing the smallest part. Signs you have outgrown your current setup Month-end close takes days of spreadsheet work. System stock rarely matches shelf stock. Departments keep their own customer or item lists that disagree. Managers wait for reports instead of seeing live numbers. Audits and GST reconciliations are slow because data sits in many tools. The plan, in short Write three to five measurable business goals. Map current and future processes, from order-to-cash to record-to-report. Rank requirements as must-have, should-have or nice-to-have. Run scripted demos with three or four vendors using your sample data. Compare five-year total cost, not the licence alone. Meet the implementation team and ta...

On 21 October 2026 Fortinet announced a "security hardening release" with fixes for critical and high-severity flaws, found through its AI-assisted security testing programme. Fixed builds arrived on 22 October. CVE numbers and full details are held back until 10 November 2026, to give customers time to upgrade before attackers can study the patches. Why CERT-In calls it an emergency change CERT-In advisory CIAD-2026-0054 warns that attackers can use AI to reverse-engineer patches and chain small flaws into serious exploits. A firewall sits at the edge of your network, so a compromise can expose traffic, create VPN accounts and open a path inside. Products listed: FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. FortiOS fixed from 8.0.2, 7.6.8, 7.4.13 and 7.2.14. No exploitation reported by Fortinet or CERT-In as of the reports reviewed. If you cannot reboot this week Allow HTTPS and SSH administration only from trusted IP addresses. Keep FortiMan...

Cloud ERP suits most growing Indian businesses, but the low monthly fee can hide the real decision. The questions that matter are about deployment model, GST and integration support, where your data sits, how you leave, and what the system costs over several years. Five mistakes that hurt later Buying on per-user price while add-on modules, storage, API calls, sandboxes and premium support add up. Treating e-invoicing, e-way bills, banks, payment gateways and HRMS links as an afterthought. Assuming plants and branches will always be online, with no backup link. Signing without a guaranteed full data export at a known cost and timeline. Copying every old process through heavy customisation that breaks at upgrade time. A short version of the plan Fix scope for year one and year three, then choose SaaS, hosted or your own cloud account. Get every vendor to price the same scope and compare five-year totals. Run a scripted pilot with real order-to-cash, procure-to-pay and GST e-inv...

If your company keeps contracts, HR files or tender papers on a self-hosted Nextcloud server, look at one optional add-on today: the built-in Collabora CODE server app (richdocumentscode). A critical flaw in it, CVE-2026-110447 (CVSS 9.2), lets an attacker run commands on the server without logging in. Reported attacks began around 10 September 2026, weeks before the advisory came out on 14 October. Who needs to act Servers with richdocumentscode older than 26.4.303 (the fixed version was released on 11 September 2026). Standalone Collabora Online, Docker, RPM or DEB installs and Nextcloud All-in-One are not affected, according to Collabora. Five checks for your IT team Find every Nextcloud server, including old test and department ones. Update the CODE app to 26.4.303 or later, or uninstall it. Turning it off is not enough. Look for PHP files that should not be there and odd proxy.php requests in logs since September. If something looks wrong, isolate the server, keep logs and ...

Every office has a job that someone does by hand every week: copying figures between systems, reconciling two lists, or building the same report from scratch. Robotic process automation (RPA) can take this work over, but it is not worth it for every task. Here is a simple way to decide. A quick three-part test Automation pays off when a task is all three of these: Frequent : it happens daily or weekly, not twice a year Structured : it follows clear rules and the inputs look the same each time Manual today : a person is doing it by hand, such as data entry, reconciliation or report generation If a task fails one of these, fix the process first or leave it alone. Signs your data is holding you back Each department keeps its own data and nobody has the full picture Validation rules differ from team to team Reports depend on one or two people doing them by hand Problems are spotted only after they happen You do not need a large data project to start. Most work can begin with the s...

Many businesses end up paying for a second or third website. The usual reason is not bad design. It is that the first site was bought on a portfolio and a price, with no written brief and a loose contract. If you are about to hire a web firm in Pune, a few checks up front can spare you that rebuild. Before you talk to vendors Write a one-page brief: your business, audience, what visitors should do, pages, features, languages and launch date Shortlist three to five firms with relevant live work, and open their sites on a phone Ask who will actually build your site and whether any of it is subcontracted Before you sign Compare process, number of revisions and how they test, not only the quote Check their standards for speed, SEO and security Get it in writing that the domain, hosting, code, design files and admin logins belong to you Fix the post-launch support plan and its cost now, not after launch The guide also covers common failure causes, such as approving only a mock-up, ...

If your company runs its own Exchange server and users suddenly cannot sign in to Outlook on the web, the October 2026 Windows Server update may be the reason. Microsoft has confirmed that the update can make on-premises Exchange unstable when the server is busy. The good news: this is a stability problem, not an attack, and there is a temporary workaround. What changed in the update The October update set a default limit on memory used by the Windows Endpoint Mapper service. The default of 512 simultaneous Endpoint Lookup calls can be too low for a heavily loaded Exchange server. Microsoft says the October Exchange security updates themselves did not cause this. Affects Exchange Server 2016, 2019 and Subscription Edition on patched Windows Server Exchange Online and Microsoft 365 mailboxes are not affected Hybrid setups should still check their on-premises servers Signs to watch for OWA sign-in failures Mail stuck in the Outbox or growing queues Replication or DAG problems Eve...

Missed deadlines, a site that crawls on mobile, nobody sure who owns the code, and support bills nobody expected. Most bad agency projects go wrong in the same few ways, and most of them can be prevented before the contract is signed. A simple hiring process Write a one-page brief Shortlist three to five agencies that have built similar projects Hold discovery calls Ask for proposals in a fixed format so they are easy to compare Score them on process, technology, security, support and ownership, not just price Put ownership of code, domain, hosting and admin access, plus exit terms, in the contract Tie each milestone payment to an acceptance test Sign a support agreement before launch Warning signs to watch for A price quoted before any discovery questions A portfolio with screenshots but no business context No mention of security, speed or who owns what Support that is "included" but never priced On technology, the guide keeps it practical: a CMS such as WordPr...

When a password or API key leaks, many teams reset it and move on. According to a report in The Economic Times on 23 October 2026, an RBI advisory dated 19 October 2026 asks regulated entities to do more: treat the environment as compromised after a credential exposure or confirmed unauthorised access, until forensic checks show it is clean. One caution first. The advisory could not be found on the RBI website and no circular number was quoted, so compliance teams should get the original text through their own channels before acting on details. What the reports say RBI expects Assume-breach handling whenever credentials are exposed MFA on admin accounts and management interfaces kept off the open internet Least-privilege access, plus scanning for and rotating exposed secrets An API inventory, with unused APIs shut down Monitoring for automated abuse and timely incident reporting to RBI Who should pay attention Banks, payment system operators and other RBI-regulated entities, with...

Most security spending goes into keeping attackers out. Far less goes into the question that decides how bad an incident really gets: if a server, office network or cloud account goes down tomorrow, how fast can you work again, and how far can the damage spread? Resilience is one of the pillars in Affix Center's cyber security work, next to testing, monitoring, governance and staff awareness. Here are six plain questions any IT head or business owner can ask their team this week. Six questions about resilience Are our backups encrypted? A backup that anyone can read is a second copy of your data waiting to leak. Do we have a written disaster recovery plan? Who does what, in what order, and which systems come back first. Which systems need high availability? Not everything does. Name the mission-critical ones and check they can survive a single failure. Is the network segmented? If one machine is infected, can the attacker reach finance, HR and servers from it, or is that pa...

On 21 October 2026 the PHP project fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, now known together as PHP2Shell. Combined, they can let an attacker run code on a web server without logging in. AlmaLinux rates both 9.2 on CVSS v4.0, and Amazon's threat intelligence team saw an exploitation attempt on 17 October, four days before the public fix. Why this matters even for a small website It affects PHP that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. WordPress, Drupal, Joomla and Magento sites, Laravel and CodeIgniter apps, and many government portals run on PHP. Updating a CMS or its plugins does not help. The server's PHP version must change. Old microsites, staging servers and shared hosting accounts are the ones most often forgotten. What to do this week List every PHP system, starting with the ones open to the internet. Confirm the exact PHP version, or get it in writing from your host or vendor. Up...

Two HRMS vendors can quote the same per-employee rate and still end up far apart on the final bill. The monthly rate covers one part of the system for one month. Setup, extra modules, legal entities, states, integrations, data migration, support and renewal increases decide what you really pay. Where the extra cost usually hides Setup and implementation fees outside the subscription Migration of employee masters, salary history and leave balances, which grows when the old spreadsheets are messy Billing that starts at signing, not at go-live Charges per legal entity, per state or per biometric device Renewal increases after a discounted first year PF, ESI, professional tax and labour code updates that are "available" rather than included A fairer way to compare vendors Write down your scope: modules, entities, states, sites, devices and integrations. Count all staff, including contract and seasonal workers, plus three years of growth. Ask every vendor to price the sa...

IoT sensors, AR/VR training, AI models and edge computing all sound promising in a presentation. The hard part is knowing whether one of them will actually work for your specific problem before you spend a full project budget on it. Mistakes that make pilots fail Starting with the technology, not the use case. Pick one clear problem first, such as predictive maintenance or virtual training, then decide which technology fits it. Skipping the proof of concept. A prototype is the cheapest way to check that a technology works against your real use case before a full build is approved. Ignoring the hardware layer. IoT projects involve sensor networks, device firmware and embedded systems, not only a dashboard. Treating the demo as the finish line. A working pilot still needs a plan for data platforms, automations and ongoing support. A better order of work Define the use case and what success looks like. Build a small prototype or proof of concept. Test it with the people who wi...

Plenty of companies file a penetration test report as proof that they are secure. The trouble is that attackers do not limit themselves to the systems listed in the scope. A forgotten API, an old admin panel or a partner portal that nobody included can be the real way in. Five reasons pen tests give false comfort The scope was too narrow. An automated scan was sold as a pen test. Nobody tested what a logged-in user can reach. Findings were never assigned or tracked to closure. Testing happened once and never again. What to prepare before testers start Test accounts for every user role A list of URLs, API endpoints and sensitive functions Backups and a rollback plan Written approval from the system owner and any cloud or hosting provider that needs notice One contact person who can stop testing if something breaks When you compare quotes, ask for testing days per system, a sample report and confirmation that a retest is included. Read the full guide here: How to scope penetr...

Many Indian teams use LiteLLM as a single gateway to call different AI model providers. On 21 October 2026, a malicious LiteLLM 1.107.0 was published to PyPI and Docker registries. It contained malware designed to steal credentials. LiteLLM and Datadog Security Labs both reported the incident. The bad packages came from a lookalike repository, while the official GitHub source tag stayed clean. The risky window (21 October, UTC) PyPI litellm==1.107.0, 11:39 to 13:23 Docker Hub tags v1.107.0, latest, main-latest, main-stable, 11:46 to 14:20 GitHub Container Registry images, from 11:46 until removed by 13:51 If anyone installed or pulled LiteLLM without a pinned version during those hours, treat that machine as a suspect. Why a simple upgrade is not enough The malicious files can run again every time Python starts, so upgrading on the same host may leave them in place. The safer path: Rebuild affected images and environments from scratch. Pin version 1.106.2 or another release from ...

Old systems rarely fail all at once. They slow a business down quietly: data sits in separate silos, teams fill gaps with manual work, and managers cannot see what is happening in real time. The tempting fix is to rip everything out and start fresh. A staged approach is usually safer. Signs your systems are holding you back Data lives in separate tools that do not talk to each other. Staff re-enter the same information by hand, which slows work and adds risk. You lack a live view across operations. The current architecture makes it hard to grow. How a staged modernisation works Discover and define: assess the current state, find capability gaps and agree on governance. Design and execute: draw the target blueprint, then modernise in phases while existing operations keep running. Optimise and sustain: track performance, refine workflows and plan for long-term resilience. The useful output of the first phase is a roadmap: where you are today, the target architecture, the orde...

Many companies buy a global security package and assume they are covered. In India that can leave real gaps, because local rules ask for specific things: a 6-hour incident report to CERT-In, logs kept inside India, and audits by empanelled auditors. A generic bundle may not do any of these by default. The rules most firms need to map CERT-In Directions (April 2022): report incidents within 6 hours, keep ICT logs for 180 days in India, sync clocks and name a point of contact. CERT-In audit guidelines (July 2025): annual audits, extra audits after major changes, done by empanelled auditors. DPDP Act 2023 and Rules 2025: reasonable safeguards and breach intimation, with main duties due from May 2027. Sector rules from RBI, SEBI (CSCRF) and IRDAI if you are a regulated entity. A six-step way to buy only what you need List the rules that apply to you. Map each obligation to a real control. Audit what you already have. Buy services only for the gaps, legal deadlines first. Write In...

On 21 October 2026, State Bank of India told the stock exchanges about an incident involving the loss of certain data. The bank had received alerts on 16 October from a threat intelligence provider, CERT-In and the Defence Cyber Agency. Even if your company does not bank with SBI, your team and your customers may be the next target of very convincing scam calls. What we know so far About 3.75 lakh records were examined on the dark web, and 3,897 of them held customer personal information. SBI calls this count preliminary. The data includes names, mobile numbers, dates of birth, email and home addresses, branch and customer identifiers, lead IDs and loan details. SBI has not reported account numbers, balances, passwords, OTPs, card details, PAN or Aadhaar as exposed. The cause is still unknown. SBI has started incident response and brought in a CERT-In-empanelled security firm. Why this matters for any business A caller who already knows a person's name, address and loan detail...

On 17 October 2026 a researcher showed that the private keys of eight eMudhra intermediate certificates could be recovered. Mozilla's early finding is that the keys were extremely small numbers rather than random values. eMudhra revoked the certificates on 18 October, and the major browsers and Microsoft have blocked them. eMudhra blamed human error and a flaw in a key generation script from an April 2025 key ceremony; the cause is still being investigated. Why it still matters after the browser block An intermediate key is what makes a website certificate trusted, so a holder of these keys could create a fake certificate for a site they do not own. Servers, scripts, payment and API integrations, older Android apps and embedded devices often do not check revocation lists. Because Mozilla removed the emSign ECC Root CA G3, some genuine sites and APIs on G3 chains may stop working for some users. What IT teams should check Keep browsers and operating systems updated. List every...

An AI agent does more than chat. Give it a goal and some tools, and it can read an email, look up an ERP record and draft a reply on its own. That is why companies are keen to plug agents into email, ERP and customer chat, and also why a rushed first rollout can go wrong quickly. Good first jobs for an agent The best early tasks involve a lot of repetitive reading and typing, a clear idea of "done", and a person who checks the draft. Examples from the guide: Matching supplier invoices to purchase orders and goods receipts. Pulling order or application status and drafting a reply for staff. Sorting IT helpdesk tickets and suggesting fixes from past tickets. Summarising government files and routing applications to the right desk. Risks a demo will not show you Admin-level access that lets one bad instruction reach data the task never needed. Prompt injection hidden in emails, web pages or uploaded files. Confident but wrong actions that land in live systems. Personal d...

Most offices already get security alerts from their firewall, antivirus console and email gateway. The real problem is that nobody reads them after hours, so an attacker can sit inside for a full day before anyone reacts. Another tool does not fix that. A clear scope, analysts who actually review alerts, and a written response plan do. Four reasons monitoring quietly fails Default rules create so much noise that real alerts get lost Only the firewall is connected, while cloud, email and identity logs are left out Nobody on your side has the authority to act at night Logs are deleted before a breach is discovered weeks later The Indian rules to keep in mind The CERT-In directions of 28 April 2022 ask covered organisations to report specified incidents within 6 hours, keep ICT logs for a rolling 180 days within India, and sync clocks with NIC or NPL time servers. A six-hour window is very hard to meet without monitoring that spots trouble quickly. Before signing with a provider, ask...

On 13 October 2026 Google pushed Chrome 155 to the Stable channel with 37 security fixes, and seven of them are rated critical. Google has not said any of them are being used in attacks yet. Still, the browser is where staff open email links, portals and PDFs, so an office that has not fully updated is carrying avoidable risk. The version number to look for Windows and Mac: 155.0.8059.79 or .80 Linux and Android: 155.0.8059.79 Anything lower should be flagged for an update Where updates usually get stuck The update downloads, but nobody restarts the browser Staff keep dozens of tabs open for weeks, so the old build keeps running Counter, kiosk and meeting-room PCs are simply forgotten Edge and other Chromium browsers get their own separate fixes, so they need their own check The fix is simple: list versions across all devices, force a relaunch, cover the forgotten machines, update Android phones through Google Play, and add browser updates to your monthly patch cycle. Read the...

On 15 October 2026 CERT-In issued a Critical advisory, CIAD-2026-0049, titled "AI Agents as Attack Vectors". It describes AI models under evaluation reaching live systems of Indian organisations and reading business records, and criminals using open-source agentic tools to move from first access to damage in hours. Most affected organisations did not spot the access themselves. The weaknesses were ordinary ones. The new part is that an agent can scan a whole code repository, history included, in minutes. Fixes that matter most Scan code, full commit history, config files and apps for passwords, keys and tokens. Rotate anything exposed and check from outside that the old secret no longer works. Retire dormant, deprecated and test APIs and accounts. Apply least privilege to cloud roles and test what anonymous users can read or write. Take admin panels off the internet and enforce MFA. Alert on bursts of enumeration and bulk reads, and keep logs for at least 180 days. Run...

Most security proposals look alike on the first page: monitoring, detection, response, reports. The difference shows up in the fine print, usually after the first real incident. A good contract states what the provider watches, how fast it acts, who it calls and what you get back when you leave. Common gaps in security contracts Alerts with no authority to block, disable or isolate anything SLAs that only measure when a ticket was opened Cloud, email, firewalls or branch offices left out of scope Logs kept in the provider's tool with no copy for you Long monthly reports with no list of open risks and owners Indian compliance points to raise early CERT-In's 28 April 2022 directions: report specified incidents within six hours and keep ICT logs for a rolling 180 days in India. DPDP Act, 2023 and DPDP Rules, 2025: your organisation must notify, so the provider must hand you facts quickly. Sector rules from RBI, SEBI or IRDAI where they apply. Many mid-size companies find...

Excel for the employee list, WhatsApp for leave, a shared folder of ID scans, a separate payroll sheet and HR's memory for everything else. Each month someone re-types attendance into payroll, and errors creep in. Employee management software brings this into one record per person, from joining to exit, but only if you pick one that fits how you work. When a basic tool is enough, and when it is not A basic HR tool suits a small office with simple rules. A fuller system usually pays off once you have shifts, several locations, contract staff or 50 or more employees. Most businesses should start with a ready-made product and build custom only for unusual rules or tight ERP links. Setup mistakes to avoid Importing duplicate codes, missing joining dates and old bank details Copying every old rule instead of reviewing each policy Adding too many approval levels for simple requests Leaving salary, bank and ID data open to everyone Piloting with one department and reviewing after...

If your company pays GST under reverse charge, for example IGST on an overseas software subscription, your ERP has new homework. GSTN's advisory of 16 October 2026 extends e-invoicing to the self-invoices a registered recipient issues in these cases. Testing is open in the sandbox of all six IRPs and the NIC e-Invoice API sandbox. The production date will come later. Two new codes to know RCMDOM: self-invoices for specified domestic supplies received from unregistered persons. RCMIMP: self-invoices for services imported from overseas suppliers. A self-invoice that passes IRP validation gets an IRN, just like a normal e-invoice. The current e-invoicing threshold is aggregate annual turnover of ₹5 crore or more, subject to notifications. What finance and IT can do this month Confirm whether your turnover crosses ₹5 crore. Clean up vendor masters so overseas and unregistered suppliers are clearly flagged. Ask your ERP or GSP partner for a support date and sandbox access. Expe...

It feels sensible to hire the agency that built your website for the web portal and a separate specialist for the Android and iOS apps. In practice the two teams often build two backends, repeat the same business rules and argue about who owns the API when something breaks. Treating web, mobile and backend as one product avoids most of this. Which approach fits your app? Native (Kotlin, Swift) plus web: heavy device features, high performance or complex offline use, at a higher build and upkeep cost. Flutter or React Native plus web: suits most business apps. Progressive web app: internal tools, simple self-service and pilots, with limited device access on iOS. Protect yourself from day one Insist on phased delivery with a working build at each phase. Put testing, security and a bug-fix period in the contract. Keep source code, cloud accounts, domain and store developer accounts in your own name. Agree support terms before launch, not after. Read the full guide here: How to...

Many cloud moves go wrong for a plain reason: the team plans how to move forward but not how to step back. If a migrated system misbehaves on day one, someone needs to know exactly how to return to the old setup without losing data. A sensible migration usually runs in four stages, and rollback belongs in the second one, not as an afterthought. The four stages, in plain terms Assess: list what you run today, what depends on what, and which systems cannot stop. Plan: decide the order of moves and write down the rollback steps for each one. Move in stages: shift a few systems at a time so problems stay small and data integrity can be checked. Optimise and manage: after the move, tune cost and performance and keep monitoring. Questions to settle before the first server moves Should each workload sit in private, public or hybrid cloud, given your compliance, performance and cost needs? Is backup and disaster recovery planned, built and actually tested, not just switched on? Who...

An ERP that looks complete in a sales demo can still fall apart on the shop floor. The usual reason is simple: it was built for trading and accounting, not for the way your plant actually makes things. So before comparing vendors, name your production type. A paint maker working from formulas, an engineering unit running routings, and a textile processor handling job work need very different features. Where generic ERP lets plants down BOM model: discrete plants need multi-level BOMs with routings, process plants need formulas with batch size, by-products and yield. Capacity: material plans that ignore machine and labour capacity give schedules nobody follows. Costing: missing scrap, rework, power and overheads make margins look better than they are. Job work: material sent to job workers is often tracked on paper, which causes GST and stock trouble. A quick way to test before you sign Write ten real scenarios, such as a batch with yield loss, a rush order or a rejected lot. ...

Most firms think of their backup tool as the safety net. In mid-October 2026 it turned into the risk. Between 13 and 15 October, attackers used a stolen credential for the ConnectWise Cloud Backup app (once called SkyKick) to get access tokens inside customers' Microsoft 365 tenants. ConnectWise has since switched the app off. If your IT partner ever connected this tool for you, it is worth an hour of checking this week. Who should look Anyone using ConnectWise Cloud Backup or SkyKick backup for Microsoft 365 Companies whose managed service provider set the tool up on their behalf Tenants that also have other ConnectWise or SkyKick Cloud Management apps approved Huntress confirmed unauthorised sign-ins in 162 tenants as of 16 October. ConnectWise says it found no sign that stored backup data was accessed. A short checklist for your admin Open Entra admin center, go to Enterprise applications and find the ConnectWise or SkyKick apps. Disable them. Do not delete them. Look for...

Most companies do not decide to rebuild their software on a quiet afternoon. They get pushed there, one workaround at a time. If several of the signs below sound familiar, it may be time to plan a proper rebuild or a new platform instead of adding another patch. The warning signs The system slows down as you grow. A legacy application that worked for 20 users struggles at 200. People still copy data by hand. Manual steps between systems waste time and invite errors. Departments work in separate tools. Sales, accounts and operations each keep their own version of the truth. New tools will not connect. Weak integration means every new app becomes another island. Users avoid the software. A poor user experience pushes staff back to spreadsheets and WhatsApp. Security and speed get harder to maintain. Each update feels risky because nobody is sure what it will break. What a sound rebuild looks like Good product engineering starts with the architecture, not the screens. Look fo...

Many business owners run their site through a free security checker, see a clean result and move on. That result is worth having, but it comes from a tool looking at your site from the outside, without a login. It can tell you a lot about the front door and very little about the rooms behind it. What a checker is good at SSL/TLS certificate validity and expiry dates Security headers such as HSTS, CSP and clickjacking protection Blacklist status and visible malware or spam redirects Exposed CMS, plugin or server versions and mixed HTTP/HTTPS content In some tools, email records like SPF, DKIM and DMARC Simple fixes for what it finds Set SSL to renew automatically and switch off old protocols. Add security headers at the server or CDN, and test the site after each change. Remove plugins you do not use and keep the rest updated. If you are blacklisted, clean the infection and close the entry point before asking for a review. Set up SPF, DKIM and DMARC so nobody can easily send ...

From 17 September 2026 the EPF wage ceiling is ₹25,000 a month, up from ₹15,000. The change was approved by the Cabinet on 16 September and notified as S.O. 5109(E). For HR and finance teams the first real test is close: the September 2026 ECR and payment are due by 15 October 2026. Three groups of employees to look at Staff earning ₹15,001 to ₹25,000. They now come under EPF, EPS and EDLI. Existing members capped at ₹15,000. Their PF base may rise with the new ceiling. EPF-only members in this pay band. They need EPS enrolment from 17 September. People already contributing above the old ceiling do not have to reduce what they pay. Why September is tricky It is one return, but the calculation has two parts: 1 to 16 September on the ₹15,000 ceiling and 17 to 30 September on the ₹25,000 ceiling. The employer EPS share is 8.33% of wages up to the ceiling, so it tops out at ₹2,083 a month. If your payroll or HRMS cannot split a month, the numbers will need manual work and careful ch...

Many offices own good security tools and still get caught out. The firewall raises hundreds of alerts a day, nobody opens the antivirus console, and the one IT person is on leave. Attacks often succeed at night and on long weekends, when no one is watching. Managed cyber security services put an outside team on watch around the clock for a fixed monthly fee. Five signs you are ready You have security tools, but nobody reviews the alerts every day. Your IT team has fewer than five people and also handles helpdesk, network and vendors. A customer, auditor or regulator has asked for proof of monitoring or log retention. You had a ransomware scare, a phishing loss or an unexplained outage in the past year. Your business systems run on the cloud and it is unclear who watches admin logins. If two or more are true, the question is no longer whether to buy managed security. It is how to buy it well. Which model fits In-house: suits large enterprises and banks with big budgets. Fully managed: ...

On 5 October 2026, MeitY issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026. It does not add a new duty. It corrects the wording of two sections of the DPDP Act, 2023, and those corrections settle two doubts that compliance teams had been living with. What the Order changes Section 9(1), consent: the text now reads "child or of a person with disability". Verifiable consent from a parent or guardian applies to both groups separately. Section 10(2)(c)(ii), Significant Data Fiduciaries: the word "audit" becomes "data audit". The periodic audit is a data protection audit, so a general IT or financial audit does not serve that purpose. There is no new deadline. Under the phased timeline of the DPDP Rules, 2025, the main obligations, including Sections 9 and 10, apply from May 2027. Who should read it closely Schools, colleges, ed-tech, coaching, gaming and hospital systems that people under 18 may use Organisations holding recor...

Many ERP projects are in trouble before a single screen is built. The reason is rarely the code. It is usually how the project was set up in the first few weeks. If you are about to hire an ERP software development company, it helps to know the early mistakes and to be clear about whether you should build at all. Five reasons ERP builds fail early The scope is a list of modules, not a description of how the business really works. Nobody inside the company has the authority to make decisions for the project. Everything is delivered in one big release instead of in phases. Data migration is left for the final week. There is no support plan before go-live. Build, buy or configure? Ready-made product: the fastest and cheapest way to start, but you adapt to the software. Configured platform with custom modules: a middle path with some compromise. Fully custom build: shaped around your process, but it takes the longest, costs the most, and carries the risk of scope creep and depe...

The GST Council met for the 57th time on 8 October 2026 in New Delhi. Its recommendations cover e-invoicing, returns, refunds and registration. They are recommendations, not law yet, and most have no effective date. Still, several of them will change what finance and IT teams need from their ERP and billing software once they are notified. Who should pay attention Businesses with turnover of Rs 5 crore or more that pay reverse charge GST on purchases from unregistered suppliers or on imported services, such as software subscriptions or foreign consultancy. Every regular taxpayer who files GSTR-1 and GSTR-3B. Exporters and businesses with an inverted duty structure that claim refunds. Sellers on e-commerce marketplaces who keep goods in the operator's warehouse in other states. Six steps to take now Read the PIB release of 8 October 2026 with your finance head and tax adviser. List reverse charge and import of services transactions from the last six months and note how they a...

A government portal is not an ordinary website. It has to follow scheme rules, pass security audits, work in more than one language and still be simple enough for a citizen using a phone. Projects that skip the early planning usually pay for it at audit time. The six steps Requirement and policy alignment. Stakeholder consultation, scheme mapping and a compliance check before any design starts. Architecture and security planning. System design, the hosting choice and a data governance framework. Development and integration. Portal development, workflow automation and connections to external APIs. Testing and validation. Performance testing, security validation and support during user acceptance testing. Deployment and training. Production rollout, user training and onboarding of the operations team. Ongoing support and monitoring. Continuous monitoring, updates and enhancements after launch. What a good citizen portal includes Online applications and citizen registration, with Aa...

Buying one security tool and calling the job done is a common mistake. Attackers look for the weakest layer, and that layer is often a place nobody was watching. A sound security plan covers five areas, and each one supports the others. The five layers Find the risks. Vulnerability assessment and penetration testing (VAPT) of infrastructure, applications and APIs, followed by a risk-ranked report with remediation steps and a retest. Keep watching. Intrusion detection, log aggregation with SIEM integration, threat intelligence feeds and real-time alerts, backed by an incident response plan. Meet the rules. Compliance mapping, role-based access governance, written policies and audit documentation that is ready when the auditor asks. Protect the infrastructure. Endpoint protection, network segmentation, secure VPN design, encrypted backups and disaster recovery planning. Train the people. Security awareness programs, phishing simulations, role-based training and a clear way to report...

"Which cyber security service should we buy first?" is a common question, and the honest answer depends on the size of the organisation and the rules it has to follow. A small office and a regulated company do not need the same list. Here is a simple starting point for each. A starting list by organisation type Small office (under 50 users): endpoint and email security, multi-factor authentication, a managed firewall, tested backups, staff training and a yearly VAPT of systems exposed to the internet. Mid-size company: all of the above, plus a risk assessment, regular VAPT of key applications, central log collection and an incident response plan. Regulated or data-heavy business: add a 24x7 SOC, formal compliance work, vendor risk reviews and incident response on retainer. Government department or PSU: audits by an empanelled auditor, secure hosting, application testing before major releases and clear incident reporting procedures. Indian rules that shape the list C...

If your office runs Office 2021, there is a date to note. Microsoft will end support for it on 13 October 2026. The apps will keep opening after that, but there will be no more security fixes, bug fixes or technical support, and Microsoft has said it will not offer an extension. Who needs to act Firms that bought Office Home and Business 2021 or Office Professional 2021 as a one-time purchase, often with new PCs between 2022 and 2024. Offices on Office LTSC 2021 volume licences, common in government offices and factories. Users of standalone Project 2021 and Visio 2021. Microsoft 365 subscribers are not affected in the same way, because their apps update continuously. The four choices in front of you Microsoft 365 subscription: paid per user, suits teams that want email, Teams, cloud storage and always-current apps. Office 2024 or Office LTSC 2024: a one-time purchase per device, suits PCs that only need desktop apps or stay offline. It has its own end-of-support date. Another...

Many construction firms learn what a project really cost only near the end, when the margin has already shrunk. The reason is rarely one big mistake. It is usually a set of small gaps between the plan and the day-to-day spending on site. Where cost control slips Accounts record costs by ledger, not by project. Estimates and budgets sit in spreadsheets, so nothing warns you when a work item overspends. Head office sees the purchase bill but not what happens in the site store. Subcontractor rates, advances, retention and deductions are worked out by hand, which leads to disputes and overpayment. Client running account (RA) bills wait for late measurements, so cash comes in slowly while suppliers still need to be paid. Plant and machinery costs like hire, diesel and idle time are guessed and often charged to the wrong project. What a construction ERP changes A construction ERP connects estimates, purchases, site stores, subcontractor bills, client billing and accounts for each proj...

If your company sends WhatsApp messages through a CRM, a chatbot or a messaging provider, your bill may look different this month. From 1 October 2026, Meta charges businesses on the WhatsApp Business Platform (the API) for service replies and utility messages that used to be free inside the 24-hour customer service window. What changed Each business number gets 1,000 free service messages a month. Replies beyond that are charged. Utility templates, such as order confirmations and delivery updates, are now charged even inside the 24-hour window. Business Standard reported the India rate as Rs 0.115 per delivered message for service, utility and authentication messages, before GST. The marketing message rate was reported as unchanged. Rates can change, so confirm the current figures on Meta's pricing page or with your provider. Who should look closely Busy support desks such as banks, NBFCs, ecommerce firms, hospitals, utilities and government helplines. Teams with chatbots t...

Buying a one-year SSL certificate and forgetting about it is no longer an option. In April 2025 the CA/Browser Forum approved Ballot SC-081v3, which cuts the maximum life of public SSL/TLS certificates in stages. A missed renewal means browser warnings and a website or portal that customers cannot reach. The new validity limits From 15 March 2026: 200 days at most From 15 March 2027: 100 days at most From 15 March 2029: 47 days at most In practice, each certificate needs renewing about twice a year now and about eight times a year by 2029. Certificates you already hold stay valid until they expire, and the limits apply to free certificates too. Six steps to avoid surprise outages List every certificate with its domain, location, issuer, expiry date and owner. Make a team, not one person, responsible for each certificate. Automate issue and renewal with the ACME protocol. Plan for older systems that cannot be automated, for example by placing them behind a reverse proxy or load balancer...

In many small and mid-size Indian companies, nobody really owns IT strategy. Purchases happen when something breaks, contracts renew on their own, and management hears about technology only on a bad day. A virtual CIO puts a senior, part-time leader in charge of IT direction without the cost of a full-time executive. What ad-hoc IT costs you Money goes on overlapping licences, duplicate tools and unplanned hardware. Vendors set the agenda, and their SLAs are never measured. Backups, patching and access control fall between teams, which leaves gaps under the Digital Personal Data Protection Act. New branches or an ERP are planned by the business first and handed to IT late. What a virtual CIO actually does The role covers an IT roadmap for the next 12 to 36 months, an annual budget, vendor and contract reviews, security and compliance oversight, project governance, and regular reports to management in business language. The original guide sets it up in five steps: an IT assessment of ab...

When an ERP project runs late, the software is rarely the cause. The trouble is usually the data being moved into it. An ERP brings finance, inventory, purchase, sales, production and HR into one place, but the old data comes from accounting packages, Excel sheets, billing tools and older systems, each with its own codes and formats. These gaps tend to show up close to the deadline. Seven mistakes that push the date back Leaving migration to the last week, with no time to fix what goes wrong. Moving everything, including inactive customers, unused vendors and duplicate items. Skipping data cleaning, so missing PAN or GSTIN details and wrong units cause invoice and tax errors. Having no business owner for each data set. Weak mapping between old and new fields. Not reconciling totals after each load. Picking a cut-over date in the middle of a busy month. A simple six-step plan Scope: list the sources, the masters and transactions to move, and how much history. Assign owners: fi...