Category: Blog

Get a Jump on Holiday Shopping: Key November Dates

3 min read

Holiday ShoppingFor some of us, last-minute holiday shopping is just what we do. That said, it’s probably never fun, and two things invariably seem to happen: The gifts you want aren’t available, and you end up paying too much. That’s why shopping in November to get the best savings on what you want just might be the right thing to do this year. Here are a few sales dates to put on your calendar.

Singles Day, November 11. Originally started in China as a humorous “anti-Valentine’s Day” event, it’s become one of the biggest shopping days of the year, surpassing Black Friday and Cyber Monday. To top it off, the date, 11/11, was chosen because it symbolizes, you guessed it, four ones – aka singles. On this day, you can find huge discounts at a lot of high-end clothing stores like Athleta, Nordstrom, Lululemon, Abercrombie & Fitch, Madewell, Neiman-Marcus, and J. Crew, to name a few.

Pre-Black Friday, November 20-27. Yes, there is such a thing, as if Black Friday isn’t enough in and of itself. Nevertheless, lots of retailers get in on this. This year, you’ll want to check out early access on holiday deals at Costco, Lowe’s, Best Buy, as well as Kohl’s, GameStop, and PetSmart. You can find other merchants who offer deep discounts here.

Black Friday, November 28. It’s probably the most famous shopping day of the year, where you’ll find huge price cuts across all categories. If you’re into tech stuff, head to Apple, AT&T Wireless, Dell, Google, HP, Lenovo, or Micro Center to start. The big box places to hit are Walmart, Target, and Sam’s Club. For home goods, you’ll find savings at Bed, Bath & Beyond, Ashley Furniture, and Crate & Barrel. If you want a comprehensive list, go to blackfriday.com. (See? There’s even a website dedicated to this day!) But get ready to scroll because there’s a lot there.

Small Business Saturday, November 29. Originally launched in 2010 by American Express, this day is all about shopping at your local stores. So hit your neighborhood shops, markets, coffee shops, and boutiques to support your friends and neighbors. If you don’t know where to start and don’t have a lot of time, just Google “small business Saturday sales near me” and you’ll be good to go.

Cyber Monday, December 1. To cap off all the November savings, you can’t forget this day. And yes, it’s not technically in November, but that’s OK. This date is great because you can let your fingers do the shopping. Online-only offers are king, so hunker down and start searching. Some places with the biggest deals are, again, (and not surprisingly) Amazon, Target, and Walmart – the big three. For more price-cutting goodness, go here.

Life gets busy around this time of year, but if you take a moment, get your list and hit a few of the aforementioned stores, you’ll be way ahead come the holidays. And that just might be the best gift of all.

 

Sources

Holiday Shopping Calendar: Key Discount Dates 2025 | GiftList Blog | GiftList

https://giftlist.com/blog/holiday-shopping-calendar-key-discount-dates-2025

Controversial Defense Funding Bill, Shoring Up ESOP Plans, and Leave Benefits for Public Health Personnel

3 min read

Shoring Up ESOP PlansNational Defense Authorization Act for Fiscal Year 2026 (S 2296) – Introduced by Sen. Roger Wicker (R-MS) on July 15, the Senate passed this legislation on Oct. 9. The bill is a carve-out of the 2026 budget bill intended to fund military appropriations for the 2025-2026 fiscal year. The bill was largely supported by Republicans but less so by Democrats, who are in favor of keeping the government closed until all of their budget concerns are addressed. In addition to establishing funding and policies for military and defense-related activities, the bill includes a roadmap for bomber modernization, a real-time database for contractor compliance oversight, and authorizing programs for nuclear weapons facilities. The legislation would authorize $32.1 billion over the President’s budget request, and the White House opposes provisions in the bill that thwart the President’s ability to control immigration and conduct foreign affairs, including submitting plans to Congress ahead of actions, dictating the terms of intelligence support to Ukraine, and enabling the Defense Department to bypass the Administration’s tariffs. The bill currently rests with the House, which asserts it will not return to regular session until the Senate passes the current controversial CR budget bill.

Employee Ownership Representation Act of 2025 (S 1728) – This bipartisan bill seeks to expand the membership of the Advisory Council on Employee Welfare and Pension Benefit Plans to include two representatives of employee ownership organizations. While the council presently includes 15 members from business, labor, and the public, the council has no expertise specific to Employee Stock Ownership Plans (ESOPs). The legislation was introduced by Sen. Bill Cassidy (R-LA) on May 13 and passed in the Senate on Oct. 9. It currently awaits consideration by the House.

Retire Through Ownership Act (S 2403) – The main purpose of this bill is to provide a clear definition for certain closely held stock that aligns valuations with IRS standards in an effort to mitigate valuation risk for ESOPs. It would also provide “safe harbor” for trustees relying on these guidelines. The Act was introduced by Sen. Roger Marshall (R-KS) on July 23. It passed in the Senate on Oct. 9 and currently lies with the House.

Uniformed Services Leave Parity Act (S 1440) – Introduced by Sen. Tammy Duckworth (D-IL) on April 10, this legislation would authorize leave benefits (parental leave, emergency leave) to Public Health Service (PHS) officers. The bill sponsors assert that the current lack of these important benefits is a challenge to recruiting and retaining PHS personnel, who should be on par with the same benefits offered to uniformed service members. The bill passed in the Senate on Oct. 9 and is up for review in the House.

Internal Revenue Service Math and Taxpayer Help Act (HR 998) – This bill was introduced on Feb. 5 by Rep. Randy Feenstra (R-IA). Among other provisions, it instructs the IRS to provide taxpayers with details of notices that relate to a math or clerical error. The bill passed in the House on March 31 and in the Senate on Oct. 20. It currently awaits the President’s signature to become law.

Why Authorization Sprawl Is the Next Big Security Blind Spot and How to Fix It

4 min read

Authorization Sprawl, What is Authorization SprawlDespite major investments in cybersecurity, organizations continue to face breaches. Most security mechanisms implemented guard against threats such as password theft. However, there is a growing concern with the unchecked expansion of user access, permissions, and tokens across apps, clouds, and systems.

This growing challenge is known as authorization sprawl, and it is becoming one of the most dangerous and least visible threats in modern enterprise security.

According to insights from the SANS keynote at the RSAC 2025 Conference, attackers are increasingly exploiting this sprawl to gain legitimate, persistent access that bypasses multifactor authentication (MFA), security information and event management (SIEM) alerts, and endpoint detection and response (EDR) visibility altogether.

What is Authorization Sprawl?

Authorization sprawl occurs when access permissions multiply uncontrollably across systems, users, and applications. Every time a team or department adds a new SaaS integration, service account, or API key, another layer of permission is introduced.

In an attempt to make access to multiple applications easy, users also have single sign-on (SSO), designed to help log in once and access multiple applications securely. Here, users are granted access to several connected systems through SSO, adding to the authorization sprawl problem.

Over time, all these factors create a complex ecosystem that even security teams have a hard time tracing who can access what.

Unlike authentication, which verifies who someone is, authorization determines what one can do. When permissions expand without review, attackers take advantage of forgotten tokens, dormant accounts, or outdated roles to move freely inside systems.

Why Traditional Defenses Miss It

Most defenses focus on identity verification, such as MFA, conditional access, and endpoint protection. But once a user is authenticated, there is no monitoring. This is the blind spot that attackers exploit. Instead of breaking in, they log in using legitimate session tokens, application programming interface (API) keys, or open authorization (OAuth) grants.

The misuse of valid credentials or access tokens enables cloud-related breaches. These attacks bypass traditional detection tools because they appear to be normal activity by authorized users.

A recent incident involving Salesloft’s Drift application highlights how damaging authorization sprawl can be. Drift, an AI chatbot often integrated with Salesforce, was exploited after attackers gained access to Salesloft’s GitHub account and later its AWS environment. From there, they stole OAuth tokens and authentication credentials, exposing Salesforce data from potentially hundreds of organizations. This incident is an example of how interconnected SaaS systems and unchecked authorization links can create a cascading breach effect, where one weak point leads to multiple breaches across services.

The Business Impact of Authorization Sprawl

Aside from increasing technical risk, authorization sprawl erodes compliance, governance, and trust.

  1. Regulatory Exposure – Frameworks like GDPR, SOC 2, and HIPAA require strict access control and auditability. Untracked permissions make demonstrating compliance nearly impossible.
  2. Operational Risk – An overprivileged account can unintentionally leak data, delete configurations, or expose APIs.
  3. False Sense of Security – Zero Trust frameworks often stop at identity verification. Failing to continuously validate authorization is equivalent to protecting the front door while leaving internal doors wide open.

How to Fix Authorization Sprawl

Luckily, solving this problem does not require removing existing security controls but rather extending visibility and discipline into authorization.

  1. Conduct Regular Access Audits – Map users, roles, and permissions across your environment. Be sure to look for redundant privileges, dormant accounts, and orphaned API keys. Use tools that help visualize hidden paths and privilege escalation routes.
  2. Implement Structured Access Control – Use frameworks like role-based access control (RBAC) or attribute-based access control (ABAC). Standardizing roles ensures fewer exceptions and easier auditing.
  3. Automate Reviews and Revocations – Integrate identity and access management (IAM) with HR systems so access automatically changes when employees leave or change roles. This helps eliminate the temporary access that never gets removed.
  4. Shorten Token Lifetimes and Rotate Credentials – Session tokens and personal access tokens (PATs) should have an expiration period, such as 30 to 90 days. Using automated key rotation policies will help prevent long-lived access tokens from becoming backdoors.
  5. Enforce the Principle of Least Privilege – Grant users and systems only the minimum access needed.
  6. Extend Zero Trust to Authorization – Verification shouldn’t end with login. Apply continuous authorization checks.

Conclusion

As cloud ecosystems, APIs, and integrations continue to multiply, authorization complexity will grow exponentially. Businesses that invest in mapping and controlling authorization sprawl will stay ahead of both attackers and regulators. In cybersecurity, visibility equals control, and this begins with knowing exactly who can do what.

Understanding Contribution Margin After Marketing

3 min read

Contribution Margin After Marketing (CMAM)Contribution margin after marketing (CMAM) measures how much money is generated per unit retailed after factoring in a company’s variable costs, along with marketing costs.

It’s analogous with contribution margin, however, a business must factor in marketing costs the company experiences when publicizing a good to likely consumers with details on the business’ wares. This metric determines how well net sales can satisfy expense obligations and what percentage of net sales may remain to satisfy fixed expenses.

Comparing Variable Versus Fixed Costs

Variable costs, as the name implies, are expenses that rise and fall according to output quantities. Fixed costs, conversely, are expenses that don’t change despite variation of production quantities. Understanding these concepts is helpful when calculating CMAM to see how both types of expenses impact the different calculations.

CMAM = Sales Revenue – Variable Costs – Marketing Expense

It can also be determined on a per-unit basis to help a business understand how a single product unit contributes to the company’s comprehensive profits. One can calculate the CMPU (contribution margin per unit) as follows to provide a more granular analysis:

CMAM/Unit = Sales Revenue/Unit – Variable Expenses/Unit – Marketing Expense/Unit

What separates variable costs (including marketing expenses) from the sales revenue is CMAM. The balance is profit along with fixed costs. To calculate if a business saw a net loss or profit, the formula is:

Net Operating Profit = CMAM – fixed costs

If a profit is reported after subtracting variable costs, costs to market, plus fixed costs, it means a business or specific department is profitable. If it’s negative, the business sees a loss that won’t enable it to pay its bills.

Illustrating CMAM

When it comes to a company producing widgets, the following is already known. Variable costs for production for a single widget are detailed below:

  • $2.25 for unprocessed inputs
  • $1.80 firsthand production expenses
  • $0.50 power
  • $0.40 freight expenses
  • $4,500 business equipment rentals
  • $6,000 factory rent
  • $30,000 management salary
  • $10,000 marketing costs

Each widget costs $10, and the business sold 30,000 last year. Therefore, it’s calculated as follows:

CMAM = Sales Revenue – Variable Costs – Marketing Expense

Sales Revenue = $10 x 30,000 = $300,000

Variable Costs = ($2.25 + $1.80 + $0.50+ $0.40) x 30,000 = $4.95 x 30,000 = $148,500

CMAM = $300,000 = $148,500

The next step is to calculate net operating loss or profit: we take CMAM ($148,500), then subtract fixed costs:

$148,500 – ($4,500 + $6,000 + $30,000)

$148,500 – $40,500 = $108,000

Based on that calculation, the company producing widgets realized $108,000 for its net operating profit last year. The next section will discuss how businesses can use this information to improve their operations.

Using CMAM for Business Analysis

Managers use this metric to determine the viability of a product. If there are multiple iterations or options of a product, it can help managers determine which product sells the best and rank them if there are multiple versions of a widget. Businesses can analyze each unit’s contribution margin for each version of a widget to determine which versions provide the greatest option for profitability. Depending on the outcome, the company may choose to produce only the most profitable one or two widgets.  

When it comes to the CMAM, businesses that use it for analysis can increase their sales efficiency for the present and future.

Ideas for Small Business Succession Planning

4 min read

Small Business Succession PlanningIt can be hard to build up your own business, but it can be harder to sell it for what it’s worth. In fact, only around three in 10 family-owned businesses survive for the next generation. Whether family-owned or in a partnership of non-family owners, business succession is no easy feat.

Succession Planning

It is very important to have a succession plan, even if the business is fairly new. That’s because it gives heirs a roadmap for what to do if the owner dies unexpectedly. The first step is to figure out who you want to run the business after you. If you want to pass it on to one or more family members, be sure to ask if they’d like to own it. Note that the family route may need to be considered a year or more before the transfer to ensure the successive owner has time to learn the ropes.

If you decide to sell the business to a third party, consider if you want to sell it outright or retain partial ownership and continue to get a share of the profits. Also, think about whether or not you want to participate in running the business once ownership changes hands.

Business Owner Partners

In the case of a shared business, a succession plan can help clarify the intent of both owners and provide a legal path of succession if one owner dies. In a worst-case scenario, instead of the surviving partner taking the reins to run the business on his own, he may end up having to run it alongside the deceased owner’s spouse, who might not possess the skills, experience, or proclivity for the business. Or maybe the surviving spouse decides not to sell the business but receive a share of the profits without doing any work.

Key Man Insurance

If the surviving owner would simply like to buy out the deceased owner’s interest in the business, there are certain financial strategies available in the event he doesn’t have the assets to do so. One vehicle is called key man insurance, which refers to policies paid for by the business to cover the death of the business owner. Death proceeds are specifically earmarked to keep the business operating upon the death of the owner.

Buy-Sell Agreement with Life Insurance

A succession plan that includes a Buy-Sell Agreement contract specifies what will happen to the business shares of the owner upon his death. In most cases, the surviving business partner will use the life insurance proceeds to buy the shares at a predetermined value, which ensures that the deceased’s family is adequately paid for his share of the business upon his death.

Family-Owned Business

In the case of a family-owned business, a family member who is active in the business may take out an insurance policy on the owner and use the proceeds to buy out the interests of the non-active family members after the owner dies.

Private Annuity

Another option is a private annuity, in which the owner sells his business to his children in exchange for a fixed annuity income, based on IRS interest rates, for the rest of the owner’s life and, if elected, that of his spouse. If the owner outlives his life expectancy, the children may end up paying him more than the business is worth. However, if the owner dies sooner, they may pay less than the business is worth.

Family Limited Partnership

With a family limited partnership, the business owner transfers some or all of his business to individual family members while he is alive. When the owner dies, the portion of the business that has been transferred is no longer considered a part of the owner’s estate and is therefore not subject to estate taxes.

Seller Financing

If the owner has trouble selling the business to a third party, including perhaps a valuable employee who would like to take over, consider a seller financing agreement. Instead of paying the owner a lump sum, the buyer pays him a fixed, regular payment over a set number of years. Future business revenue secures the note, and the current owner would be qualified to know how well business revenues might hold up under the new ownership. Some sellers set up a finance agreement for just five years or so, after which time the buyer is expected to qualify to refinance with a conventional loan. It’s also possible for the financier to sell the new owner’s note if he decides down the road to get out of the financing role. The good news is that, should the buyer default on the loan, the seller would still own the company.

How to Save Money with the Half Rule

3 min read

What is the Half Rule?What if you could lower your grocery bill without giving up the things you love, fight inflation, and have some money left at the end of the month? Sounds too good to be true? It’s not. It’s the Half Rule. This means cutting the amount of product you use in half and seeing what happens.

Truth is, most of us probably use too much of the things we love. Here are several reasons why:

  • Manufacturers often ask you to use more of the product than you need.
  • You’ve probably gotten used to using a certain amount of a product;
  • And finally, product inflation. Specifically, you might think that if you get pleasure out of something, you might need to use more of it. For instance, why get a tall vanilla latte when you can get a grande, right? But ask yourself: Is it really that much better?

To this end, here are some things you can easily use half of and never miss the other half:

  • Shampoo. Try using half the amount and adding more water, especially if it’s concentrated.
  • Laundry detergent. Try a half cup. A little goes a long way, especially if it’s a small load.
  • Dryer sheets. These are so easy to tear in half.
  • Cooking oil. Use an oil mister instead of pouring it into your pan or skillet.  
  • Restaurant meals. Eat half or a third and save the rest for another meal. Or better yet, split a meal with your partner, friend or work colleague. Bonus: you’ll also save calories.
  • Bagels. Just eat half! Save the other half for your next snack or breakfast.
  • Starbucks order. Try a tall. Or if you get a vente, try a grande. Give it a whirl. See what happens.
  • Glass stovetop cleaner. If you use less, you might have fewer streaks.
  • Tape. When you’re wrapping gifts, give string a try.

When you change a few things here and there, over time, you’ll really see the difference in your bank account. Also, imagine how nice it’ll feel not to have to buy these items so often. That’s a big change in spending.

The Half Rule is not for everything. While it works on so many things, there are some things you cannot to apply it to – like filling up your gas tank or cutting a prescription in half. Never do that.

Overall, it’s a good rule. And when you’re persistent over time, you’ll start to develop a habit – one that will help you see a difference quickly and save you money in the long run. It’s a ripple effect that might expand into other areas of your life. In sum, the Half Rule is so effective, you just might go all in – and stay there.

Sources

“The Half Rule” – A Frugal Hack I Live By

Enhancing Homebuyer Protections, Wildfire Risks, 911 Response and Domestic Manufacturing

3 min read

HR 2808, HR 2483, HR 3400, S 306, S 725, S 433Homebuyers Privacy Protection Act (HR 2808) – Introduced by Rep. John Rose (R-TN) on April 10, the House passed this bill on June 23, and the Senate passed it on Aug. 2. Signed into law on Sept. 5, this bipartisan bill prohibits a consumer reporting agency from selling a mortgage applicant’s personal information to other lenders without their explicit consent. The legislation is designed to safeguard homebuyers’ personal financial information and eliminate the frequent bombardment of other lender marketing offers during the financing process underway with the applicant’s existing lender.

SUPPORT for Patients and Communities Reauthorization Act of 2025 (HR 2483) – This bill renews billions of dollars in federal funding for programs responsible for preventing overdoses and further strengthening treatment and recovery services. The renewal of funds to nationwide county programs is timely, given the current behavioral health and substance abuse disorder crises. The bill was introduced by Rep. Brett Guthrie (R-KY) on March 31, passed in the House on June 4 and in the Senate on Sept. 18; it currently awaits signature by the president.

TRAVEL Act of 2025 (HR 3400) – Also known as the Territorial Response and Access to Veterans’ Essential Lifecare Act, the purpose of this bill is to enable VA physicians and specialists to travel to hard-to-reach areas in U.S. territories for up to one year. The Act is designed to help fill critical gaps in VA medical services across the Pacific territories by compensating providers with travel bonuses. The legislation was introduced by Representative Kimberlyn King-Hinds (R-Northern Mariana Islands) on May 14. It passed in the House on Sept. 15 and currently lies with the Senate.

Fire Ready Nation Act of 2025 (S 306) – Introduced by Sen. Maria Cantwell (D-WA) on Jan. 29, this legislation would establish a fire weather program at the National Oceanic and Atmospheric Administration (NOAA). The new program would enable scientists to better predict wildfires, fire weather, and fire risk via forecasting, detection, and modeling, as well as respond quickly to prevent devastation to families, homes, and businesses due to wildfires. The legislation was passed in the Senate on Sept. 10 and is now under review in the House.

Enhancing First Response Act (S 725) – This bill was introduced on Feb. 25 by Sen. Amy Klobuchar (D-MN) and passed in the Senate on Sept. 10. The law would reclassify 911 dispatchers as public safety workers from their current role as office and administrative support in the federal Standard Occupational Classification system. In addition, the bill contains provisions to improve access to the 911 call system during major disasters and make the system more resilient against outages and disruptions. The fate of this bipartisan bill now rests in the House.

National Manufacturing Advisory Council Act (S 433) – This Act was introduced by Sen. Gary Peters (D-MI) on Feb. 5. It seeks to establish a working group of representatives from industry, labor, and academia to advise Congress on policies and programs to enhance domestic manufacturing despite the challenges of global competition, U.S. supply chain issues, and the current tariff solution. The bipartisan legislationwas  passed unanimously in the Senate on July 14 and is currently under review in the House.

The Silent Threat: How Simple Misconfigurations Are Fueling 2025 Worst Cyberattacks

4 min read

Simple Misconfigurations Are Fueling 2025 Worst CyberattacksAs organizations invest heavily in next-gen firewalls, AI detection, and threat intelligence, grave cyberattacks have been reported as a result of overlooked misconfigurations. According to the latest statistics, about 23 percent of cloud security incidents are directly connected to misconfigurations. These missteps create easy entry points for cybercriminals that may lead to data breaches, ransomware demands, and financial loss.

What are Misconfigurations?

Misconfigurations are overlooked errors in system setups that create vulnerabilities without the need for hackers to apply advanced hacking techniques. These silent threats are human-driven oversights when configuring software, hardware, or cloud services. Good examples include improperly set permissions in cloud storage, insecure API keys left in code repositories, inadequate security monitoring, and unsecured access points like IoT devices with default passwords.

These issues arise from human error, which accounts for 82 percent of misconfigurations. This is also compounded by today’s cloud era, where businesses depend on cloud platforms, software as a service stacks (SaaS), and AI-driven infrastructure. Many organizations now use multiple providers, and this makes configurations challenging. Rushed deployment also adds to the misconfiguration problem, especially when a thorough audit is not conducted. Unlike malware or phishing scams, misconfigurations remain undetected until exploited.

2025’s Worst Cyberattacks Fueled by Misconfigurations

This year alone, there has been a surge in incidents related to misconfiguration, which is alarming. There were more than 9.5 million cyberattacks in the first half of the year. A good example is the Coinbase breach of May 2025, in which data from more than 70,000 customer records was stolen. This breach is attributed to insider threats exploiting misconfigured permissions.

Recently, cybersecurity researchers revealed a botnet campaign that exploited misconfigured DNS sender policy framework (SPF) records across 20,000 domains and compromised more than 13,000 MikroTik routers. This enabled large-scale spam and spoofing attacks.

In many regions, misconfigured VPN gateways and remote access tools have also contributed to ransomware campaigns. This is through attackers bypassing perimeter defenses by exploiting a misconfigured VPN portal.

IoT weaknesses have also seen entire networks of smart devices compromised, simply because administrators did not change the default login credentials. The entry points ranged from security cameras to industrial sensors, allowing attackers to access more sensitive corporate systems.

Why Organizations Keep Making the Same Mistakes

  • Talent shortage – Many IT teams are stretched and lack sufficient experts to catch every misstep.
  • False confidence in automation – While automated tools are a great help, they are not foolproof. Overreliance on these tools and having a set-and-forget mindset can leave room for security breaches.
  • Velocity over security – This happens when rapid delivery of product features overshadows the slower discipline of security reviews.
  • Siloed responsibility – In many organizations, security is delegated to a separate team instead of being embedded across different units like the development, operations, and business units.
  • Awareness gap – Many teams underestimate how a single overlooked setting, like an open test environment, can escalate into a full-scale breach.

Prevention Strategies and Best Practices

Fortunately, misconfigurations are one of the preventable causes of security breaches. Preventing misconfigurations requires proactive measures that include:

  • Continuous auditing and testing – It is crucial to ensure regular audits and testing of automated tools for configuration management to detect and reduce the window of exposure.
  • Adopt zero-trust models – No device or user should be trusted by default; grant only minimum access where required.
  • Strengthen access controls – Always change default device credentials, partition networks, and enforce MFA across all accounts.
  • Automated detection tools – Use cloud security posture management, compliance-as-code, and drift detection to catch misconfigurations in real time.
  • Cross-functional training and culture – Employee training is vital, as human error accounts for 82 percent of incidents. Security literacy should extend to both technical and non-technical teams.
  • Follow industry guidelines – Align with recognized security frameworks (NIST, ISO, CIS) and CISA’s published guidance on the Top Ten Cybersecurity Misconfigurations. For example, avoid using default configurations, enforce patch management, and properly segment networks.
  • Incident response readiness – Have a well-drilled response playbook to ensure minor disruption in case the defenses fail.

Conclusion

Simple misconfiguration remains a silent enabler of devastating cyberattacks through avoidable errors. Business owners must prioritize configuration hygiene to build resilient digital infrastructures and protect against future threats.

It is a clear lesson that cybersecurity doesn’t always depend on battling sophisticated hackers but rather ensuring they don’t get an easy way in.

Initial Look at the New Tax Form Schedule 1-A: Four Key Deductions for 2025

3 min read

Tax Form Schedule 1-AThe IRS has released draft Schedule 1-A, introducing four new temporary deductions within the One Big Beautiful Bill Act. If you are wondering what the new form looks like and how the calculations work, read on as we explore each below.

Modified Adjusted Gross Income (MAGI)

It is important to note that all four deductions require calculating your MAGI first, which determines eligibility and phaseout amounts for each deduction.

The Four New Deductions and How the Calculations Work

These deductions are all referred to on the schedule by their colloquial names, for example: “No Tax on Tips,” “No Tax on Overtime” and “No Tax on Car Loan Interest.” The sole exception, however, is popularly referred to as the “No Tax on Social Security” provision, which is called the “Enhanced Deduction for Seniors” on the form.

1. Tips Deduction

  • Maximum: $25,000 annually
  • Eligibility: Must receive qualified tips in customarily tipped occupations
  • Phaseout: Begins at $150,000 MAGI ($300,000 joint filers)
  • Rate: $100 reduction per $1,000 over threshold
  • Requirements: Valid Social Security number; married couples must file jointly

2. Overtime Deduction

  • Maximum: $12,500 single ($25,000 joint filers)
  • Eligibility: Only the premium portion of overtime pay (the “half” of time-and-a-half)
  • Phaseout: Same as tips deduction – begins at $150,000 MAGI
  • Rate: $100 reduction per $1,000 over threshold

3. Car Interest Deduction

  • Maximum: $10,000 annually
  • Eligibility: Interest on loans for new vehicles under 14,000 pounds and assembled in the United States
  • Phaseout: Begins at $100,000 MAGI ($200,000 joint filers)
  • Rate: $200 reduction per $1,000 over threshold
  • Requirements: Must provide VIN; loan must originate after Dec. 31, 2024

4. Enhanced Deduction for Seniors

  • Amount: $6,000 fixed deduction
  • Eligibility: All taxpayers (replaces “No Tax on Social Security” promise)
  • Phaseout: Begins at $75,000 MAGI ($150,000 joint filers)
  • Rate: 6 percent reduction of excess income over threshold

Key Points to Remember

  • All deductions are available whether you itemize or take the standard deduction
  • All require valid Social Security numbers
  • Married couples must file jointly to claim these benefits
  • Income limits mean higher earners receive reduced or no benefits
  • These are deductions, not exclusions – income is still reportable for state/local taxes

Final Steps

After you have calculated everything applicable for the four possible deductions, you will enter the total on the new line 13b on Form 1040. The total amount of the deductions entered here is removed from your income prior to calculating your tax. Remember, these are deductions and not credits, so they only reduce your taxable income and are not a direct reduction in your tax due.

You can see an example of the new draft Form 1040 illustrating this below.

Screenshot of new Form 1040

Conclusion and Draft from Status – and IRS Warning

The above provides guidance to taxpayers and professionals on how both the deductions calculations work and flow through Form 1040. The IRS warns, however, that the forms and instructions currently released are in draft form at this point. Before any forms or instructions can be released in their final state, they need to be approved by the OMB. It is not unusual for draft releases of instructions and publications to have some changes before their final release, even if only minor.

 

How to Evaluate Accounts Receivables

3 min read

Reconcile Accounts Receivable, Evaluate Accounts ReceivableAccording to the Federal Reserve Bank of St. Louis, collection agencies saw $16.28 billion in revenue in 2019. While revenues have declined somewhat in recent years, unpaid invoices are still big business. Accounts receivable aging reports can help companies identify and mitigate unpaid invoices and potentially lower a business’ need to send unpaid invoices to collection agencies.

An accounts receivable aging report analyzes how well a company manages its accounts receivables (AR) and identifies the level of any abnormalities. It looks at receivables based on their age; specifically, the time the invoice has been unpaid and outstanding. Then, once receivables have been analyzed for non-payment based on different time frames, the business can determine whether to follow up with the customer, send it to collections, or write the invoice off.

Whether it’s created manually through a spreadsheet or done in conjunction with accounting or billing software, either way the AR aging report takes data from the company’s accounts receivable ledger. The following is a general overview of how to create this report:

Step 1: Aggregate invoices and determine if any credit memos or outstanding adjustments on outstanding invoices need to be addressed first.

Step 2: Create time frames for the invoices, be it buckets such as: 1. 0-30 days. 2. 31-60 days. 3. 60+ days. These can be referred to as “aging buckets” to categorize the invoices.

Step 3: Ensure fields for customer information, invoice details, invoice amounts, notes, etc., are ready for the information to flow into.

Step 4: Calculate unpaid invoice balances and group them by customer and time frame.

While this is only an example and can be modified based upon the company’s needs, it’s a starting point for further analysis. From there, along with updating the report on a monthly, quarterly or annual basis, the company can identify how to improve its cash position by determining its weak points.

One important consideration, especially for businesses with high levels of old, uncollected receivables, is that the company’s collection practices can be re-evaluated more effectively. The analysis can show that some customers take too long, and the company needs to be more proactive in following up with them sooner. It can also convey the need to incentivize their collections with early payment discounts.

This data also enables a company to identify customers who have outstanding payments and assess the associated risk to the company’s credit rating. Especially for publicly traded companies, and even for private equity investment evaluations, investors can see how competitive or not their credit rating is compared to similar companies in the same industry. When analyzing customers, it may be necessary to tighten terms or simply stop doing business with the customer.

Companies can offer pre- or early payment terms, with discounts available to customers who pay their invoices upon receipt or within a certain time frame. During challenging conditions for a particular sector or for the economy overall, businesses can set up payment plans to maintain positive relations with certain customers.

While there’s no perfect accounts receivable aging report, an effective one will organize, identify, and reduce the likelihood of increasing numbers of unpaid invoices.

Sources

https://fred.stlouisfed.org/series/REVEF56144ALLEST