Do You Know Who Still Has Access to Your Data?

By |2026-10-13T09:46:30-04:00October 13th, 2026|Data Compliance, eDiscovery|

Most organizations know who should have access to sensitive business information. The harder question is who still has access because nobody went back and removed it.  People change jobs. Contractors complete projects. Systems change. Access needs also change.  Think of user access like keys to an office building. When someone no longer needs a key, you take it back. Digital access deserves the same discipline.  What is access governance Access governance controls who can reach organizational information and helps the organization decide whether that access remains appropriate. The basic goal is simple: give people access to the information they need

Read More
Comments Off on Do You Know Who Still Has Access to Your Data?

How to Add MFA to Legacy Systems You Cannot Replace 

By |2026-10-13T09:46:50-04:00October 13th, 2026|Cyber-Security, Email security|

Leaving a critical system protected by a password alone creates an identity gap. But replacing every legacy system is not always practical.   The better question is simple: How do you protect the systems the business still needs?  Multi-factor authentication, or MFA, adds another identity check beyond a password. For legacy environments, MFA belongs within a layered defense that also considers network security, monitoring and privileged access.  Think of a legacy system like an old suitcase at the airport. You may still need the suitcase. But you can add another protective layer around it before sending it on its way.  What

Read More
Comments Off on How to Add MFA to Legacy Systems You Cannot Replace 

Your Inbox Is Quietly Feeding Your AI Tools Sensitive Data

By |2026-09-22T05:29:15-04:00September 22nd, 2026|AI, Data Compliance|

Your AI assistant might already know things it shouldn't.  We've written before about the governance gaps AI tools create across your organization: data classification, policy, retention, the whole framework. That's the foundation, and it still applies here. But there's one entry point that deserves its own conversation, because it's the one most employees click through without thinking twice: mailbox access.  Why Your Inbox Is a Different Kind of Risk  File shares and SaaS apps usually have some access structure already in place. Your inbox doesn't work that way. A single mailbox can contain a decade of contract negotiations, client health

Read More
Comments Off on Your Inbox Is Quietly Feeding Your AI Tools Sensitive Data

Extended Security Updates for Exchange Server 2016 and 2019 end on 31 October 2026

By |2026-09-09T09:42:10-04:00September 3rd, 2026|Data Compliance, Email security|

On 20 July 2026 the Exchange Server team answered a question a lot of IT departments had been quietly hoping to hear a different answer to. There will be no Period 3.  Extended Security Updates for Exchange Server 2016 and 2019 end on 31 October 2026. Period 2 was the final window. It cannot be renewed or extended, and enrolled organizations get no further patches after that date, including for a critical vulnerability disclosed on 1 November. Roughly eight weeks from today.  What Does the Period 2 ESU Actually Cover? Less than most people assume. Extended Security Updates deliver only

Read More
Comments Off on Extended Security Updates for Exchange Server 2016 and 2019 end on 31 October 2026

Microsoft 365 Retention Is Not Backup

By |2026-09-09T09:22:47-04:00September 3rd, 2026|Cloud Migration, Microsoft 365|

Ask your IT team whether your Microsoft 365 data is backed up. You will usually get a confident yes.  Then ask a follow-up. What happens if your finance director deletes a mailbox folder in March and nobody notices until June? The confidence tends to fade around that point.  Microsoft 365 retention policies preserve data for compliance. They do not restore it. Under Microsoft's shared responsibility model, Microsoft guarantees platform availability and infrastructure resilience while you remain responsible for the data itself. Standard Microsoft 365 licenses do not include a backup solution, and the native recovery windows are shorter than most organizations assume. Does Microsoft Back Up Your Microsoft 365 Data?  Not in the

Read More
Comments Off on Microsoft 365 Retention Is Not Backup

Did the EU Delay the AI Act? What Changed in 2026

By |2026-08-25T06:59:33-04:00August 25th, 2026|Uncategorized|

Did the EU Delay the AI Act? What Actually Took Effect on August 2, 2026. Did the EU delay the AI Act? Partly. The Digital Omnibus on AI, given final Council approval on June 29, 2026, deferred high-risk obligations for Annex III systems to December 2, 2027. Article 50 transparency obligations were not deferred and took effect on August 2, 2026, exactly as scheduled.   The headline most organizations heard was simpler. "The EU delayed the AI Act." Half true, and imprecise in a way that creates exposure.   What the Digital Omnibus Actually Changed   For more than a year, August 2, 2026 anchored enterprise AI compliance planning.

Read More
Comments Off on Did the EU Delay the AI Act? What Changed in 2026

AI Tools Are Inside Your Organization. Is Your Governance Framework Ready?

By |2026-08-11T10:28:27-04:00August 11th, 2026|Data Compliance, eDiscovery|

When employees use AI tools, whether sanctioned or not, they pull organizational data into environments that may retain it, share it with third parties, or process it in ways that create compliance, eDiscovery, and records management obligations the organization never planned for.  Most organizations are already past the point of deciding whether to allow AI tools. Research published in 2026 found ChatGPT present in 71 percent of UK enterprise IT environments and Microsoft Copilot in 68 percent. The governance question is no longer about adoption. It is about whether the framework underneath can account for what those tools are doing

Read More
Comments Off on AI Tools Are Inside Your Organization. Is Your Governance Framework Ready?

When a Hotel Wi-Fi Attack Hits Your Organization: The Governance and eDiscovery Implications

By |2026-08-11T10:10:32-04:00August 11th, 2026|Cyber-Security, Email security|

Most organizations think about credential theft as an IT problem. Contain the endpoint, reset the password, revoke the session token. That is where the response starts, but it is not where it ends.  The CaptiveCrunch campaign, disclosed by Microsoft on July 31, 2026, has compromised Wi-Fi infrastructure at hotels and conference venues worldwide, delivering malware and stealing Microsoft 365 session tokens from business and individual travelers. When those credentials belong to employees in regulated industries, or to organizations with active litigation or regulatory investigations, the incident creates obligations that extend well beyond the security team.  How Do Stolen Credentials Create a Legal Hold Problem? 

Read More
Comments Off on When a Hotel Wi-Fi Attack Hits Your Organization: The Governance and eDiscovery Implications

The State of U.S. Data Privacy Laws in 2026 

By |2026-07-17T08:34:10-04:00July 17th, 2026|Privacy|

How many U.S. states have comprehensive data privacy laws in 2026?  At least 20 now have comprehensive consumer privacy laws in effect, following new statutes in Indiana, Kentucky, and Rhode Island that took effect January 1, 2026. There is still no comprehensive federal privacy law. Compliance runs state by state, and it shows.   The Federal Vacuum: Why States Are Writing Their Own Rules   Congress has debated a national privacy standard for years without passing one. Meanwhile, states kept moving. What started with California's CCPA back in 2018 has become a genuine patchwork, and the differences between laws are widening, not converging. Newer

Read More
Comments Off on The State of U.S. Data Privacy Laws in 2026 

AI and Machine Learning in eDiscovery: What Portable AI Models Mean for Legal Teams 

By |2026-06-10T05:20:29-04:00June 10th, 2026|AI, eDiscovery|

AI and machine learning in eDiscovery refer to the use of trained algorithms to automate document classification, relevance prediction, privilege detection, and pattern recognition across large volumes of electronically stored information. Portable AI models extend that capability by allowing organizations to train a model in one matter or environment and redeploy it across different platforms, cases, or data sets without rebuilding from scratch each time. For organizations that litigate frequently or face recurring regulatory investigations, that is a meaningful shift in how review economics work.  How Portable AI Models Work  For most of eDiscovery's history, AI models were platform-bound. You

Read More
Comments Off on AI and Machine Learning in eDiscovery: What Portable AI Models Mean for Legal Teams 

Messaging Architects has been providing professional consulting services around unstructured data and information governance for over 12 years.  Our topnotch experienced project management and engineering team assists organizations to address information risk management strategies, eDiscovery processes, data security and information management policies.    Information is an organizations biggest asset but it can also be that organizations biggest risk.

Go to Top