Remind Me Tomorrow

By The Most Secure Man Alive | WISECLICK Ambassador

---

The people who break into computers for a living have a favourite day of the week.

It's Wednesday.

Not because of anything they do on Wednesdays. Because of what the rest of us do on Tuesdays.

On the second Tuesday of every month, Microsoft publishes a list of every hole it has found in its own software, together with the fix for each one. The industry calls it Patch Tuesday. It's a responsible, transparent, entirely necessary ritual, and it has one side effect nobody likes to say out loud.

The other side reads the list too.

They have their own name for the day after. They call it Exploit Wednesday. That is not my joke. It's an old adage in their trade, and they earned it: patches start being pulled apart within minutes of release, because a patch is not just a repair. Compare the fixed software with the unfixed software and the difference between them points, precisely, at the hole.

An update isn't just the fix. It's the announcement of the flaw.

The Australian Signals Directorate puts the timeline in writing: once a flaw is made public, code exploiting it can be expected within 48 hours. Sometimes 24. And a note for the Mac owners, who at this point are usually feeling quietly exempt: Microsoft simply runs the ritual on a calendar. Apple publishes the same kind of notice with every Mac and iPhone update, a written list of the flaws it just fixed, for anyone who cares to read it. Same announcement. Same race. Apple just never gave the day a name.

From there, nobody comes looking for you in particular. They run tools that sweep the internet for every machine still carrying the old flaw. A man walking an endless car park, lifting every door handle. Nothing personal. Industrial. The sweep doesn't know you're a two-person operation in Wollongong. It doesn't check the logo on the lid. It only knows whether the handle turns.

The Most Secure Man Alive has read exactly one set of release notes, out of professional curiosity. He was quietly pleased to learn the other side has to read every single one.

---

The most-pressed button in Australian small business

There is a button you've pressed more than any other in your working life.

It has never once failed you. You pressed it this week. Remind Me Tomorrow.

True to its word, it reminded you tomorrow. And you pressed it again.

You know exactly where you were, too. Mid-invoice in Xero, twenty past five, dinner still to cook. Between patients, with the 2:15 already in the waiting room. In the ute, pricing a job off your phone. The little grey box slid into the corner of the screen, on the one machine that runs the whole operation, and your hand knew the way before you'd finished reading it.

And your hand had its reasons. Two of them, and they're both better than laziness ever was.

The first is fear, and it's rational. Everything is working right now. The invoices send. The EFTPOS terminal talks to the bank. There's no IT department behind you; after close, you are the IT department. If a criminal breaks your machine, you're a victim. If the update breaks it on the Thursday before the BAS is due, that was you. You were never afraid of the update. You were afraid of being alone with whatever it broke.

The second is evidence, and it's yours. A thousand of those Exploit Wednesdays have come and gone and not one of them ever touched you. It's the car that never breaks down: skip one service, nothing happens, skip a few years of them, still nothing, until the silence under the bonnet starts to sound like proof.

So let me be straight about what that silence actually was. Not because the sweep skipped you. Sweeps never skip anyone; that's what makes them sweeps. But finding an open door and doing something with it were two different jobs. The first was a script. The second took a person, someone to walk through, look around, and turn what they found into money. People are expensive, and expensive goes where the money is. A thief with a hundred open doors and one pair of hands walks through the ones with a Mercedes behind them.

Your handle got lifted a thousand times. And then, mostly, your door was left swinging.

You weren't protected. You were statistically unlikely. Those are different things.

The walking-through is a script now too. Ransomware runs as a franchise, the tools and the ransom note rented by the month, and researchers have shown the pulling-apart of patches can be largely automated with AI, straight through from patch to working attack. The race that used to require talent now requires a subscription. The thieves didn't multiply so much as each one grew a thousand hands. ASD's ledger tells the same story from our side: a cybercrime reported every six minutes, average small business losses of $56,600 and climbing, warnings to businesses up 83 per cent in a single year.

The odds that kept you safe were never a wall. They were a queue, and you were comfortably at the back of it. Automation didn't jump the queue. It abolished it.

---

The people who found out

You shouldn't have to take my word for any of this. The people worth hearing are the ones who found out, and some of them have made a point of telling the story so you don't have to live it.

A mattress-store owner in Winnipeg spent a morning locked out of his own systems and ended up negotiating with his hacker the way he'd haggle over floor stock, talking a six-thousand-dollar demand down to two before paying. His verdict afterwards, on the record with Global News, wasn't about hackers at all. It was that the whole thing could have been avoided by keeping his systems up to date.

A fifth-generation transport company in Britain traded for 158 years and then, after one attack, for only a few more weeks. Its co-owner has told that story publicly, to Bloomberg, in detail, for one reason: so that owners like you hear it from someone who isn't selling anything.

Spend an evening in the small business forums and you'll find the same post written a hundred different ways. The locked screen on a Monday. The backup that turned out to have stopped running in March. The advice to strangers, freely given, from someone still counting the cost. Every one of those posts has something in common.

They're all written in the past tense.

Closer to home, an Australian security practitioner told the Gold Coast Bulletin that the most common thing he hears from small business owners is that they're not big enough to matter. You've read this far, so you already know what he tells them: the sweep was never choosing.

And here's the detail that should quietly rearrange the furniture. Almost none of these people saw it coming, because there was nothing to see. A machine being quietly used by someone else behaves beautifully. Same speed, same startup, the bookings still landing. Modern intrusion is designed to be unremarkable, because unremarkable is what pays.

"Everything is working" is what a healthy machine says. It is also what a borrowed one says.

Hitchcock had a rule about suspense. It was never the bomb going off. It's knowing the bomb is under the table while the people sitting at it chat about the cricket. You've been sitting at that table, deciding whether to press Update, for four hundred presses. And the numbers say it without raising their voice: of the ransomware incidents ASD's cyber security centre responded to last financial year, roughly four in ten began with ASD ringing the victim to warn them. Not an alert on their own screen. A phone call from the government, to a business having a normal Tuesday.

Four in ten found out from a phone call. The screen said everything was fine.

Before that lands wrong: most machines are fine. Truly, and I'll say so plainly. But "probably fine" is a guess, not a posture, and the good news about an unanswerable question is that it doesn't have to stay one. You can look. Tonight's two-minute version: while your machine restarts after the update, open the recent sign-in page on your email account, the account holding every client you've ever had and the reset button for everything else. Google and Microsoft both keep it under Security, plainly labelled. A clean list is a genuinely good answer to tonight's version of the question. An unfamiliar entry has a calm procedure, further down.

---

The people who are starting to ask

Here's the strange part of my line of work. None of what I've told you is secret. An entire industry has spent twenty years trying to talk small business into protecting itself, with billboards and webinars and men in suits saying "wake-up call". The forums are there for anyone to read. The testimony is free. And by and large, none of it has worked. You're the proof, four hundred presses deep, and you're in excellent company.

I don't say that as an accusation. I say it because it tells us something true: warnings don't change behaviour.

Being asked does.

And the asking has started. The first person to question your security won't be a criminal; criminals don't ask. It will be a customer. The bigger client whose new supplier form has a page it didn't have last year, wanting to know how their information is stored and how quickly you install updates. The insurer whose renewal paperwork now asks the same things, in writing, with your premium listening to the answer. The accountant at the quarterly review. The tender panel that never explains why.

Trust between businesses used to be assumed. It's becoming a form.

Which means the quiet cost of Remind Me Tomorrow was never only the odds. You can go unhacked forever and still, one ordinary Tuesday, find yourself staring at a questionnaire you can't answer while a competitor answers it in five minutes. The first door it costs you might be a customer's, not yours.

---

The net: back up, then update

Which leaves only the fear, and the fear was never irrational. Updates do occasionally break things. But notice what kind of breaking it is. An update that breaks something breaks loudly, immediately, and in company: a million machines got the same update the same night, so by lunchtime the problem has a name and a forum thread, and by dinner it usually has a fix. A flaw left open breaks quietly, patiently, and alone. No thread. No fix coming. Just you, a locked screen, and wedding season starting Saturday.

Updates break things loudly and in company. Flaws break things quietly and alone.

And the answer to the fear was never courage anyway. Nobody hesitates on the trapeze once there's a net. You were never a coward; you were being asked to perform without one, and you sensibly declined.

So: net first. Back up, then press the button. Two buttons, in order. For tonight, the starter net is whatever you already own: Time Machine on the Mac, File History on Windows, even a copy of the job files and the folder marked Accounts onto a drive.

One honest note about starter nets, though. They live next to the machine, and a net tied to the trapeze comes down with it. Perfect for an update that misbehaves. No answer at all to someone who takes the whole machine. A real net is one nothing on the machine can reach: backups locked the moment they're written, that can't be encrypted, altered or deleted even if the device itself is taken. Worth knowing the difference exists. We'll come back to it.

Courage is downstream of a good backup.

---

What I do

People expect something elaborate. Here it is.

Tonight, twelve minutes. Check the net: open Time Machine or File History and read the date of the last successful backup. Today or yesterday means you're set; no tool yet means a copy of the important folders onto a drive. Then press Update instead of Remind Me Tomorrow. While it restarts, open the email account's sign-in page and read the list. That's one of the eight things the Australian Signals Directorate says matters most, done before bed. And tonight's question, answered.

This week. Automatic updates on, every device in the business. The laptop, the front-desk machine, both phones, the browser. Set once, and the button retires itself. Anything that must wait for a window, you pick the window: close of day, Friday arvo, never nine o'clock Monday with a customer at the counter.

Once a quarter. The forgotten devices. The old laptop in the drawer that still has the 2021 client list on it. The shop till. The router the internet fellow installed years ago that nobody has touched since. The machines that never prompt anyone are carrying the oldest yesterdays.

The Most Secure Man Alive has never chosen the moment, because his machines choose it for him. They update overnight, while he sleeps. Which is also when he is most secure.

---

If an update genuinely does break something

The worst case, so you can see its actual size:

1. Restart. Fixes most of it, more often than dignity would like.
2. Roll it back. Windows: Settings, then Update history, then Uninstall updates. Mac: the previous version lives in Time Machine.
3. Search the exact error message. A million machines got the same update. You'll have company by lunchtime.
4. Restore from the net you made ten minutes earlier. Which is why it exists.

An inconvenience. Not a catastrophe.

If the sign-in page shows a device you don't recognise

In order, no hurry:

1. Sign out all sessions. Same page, both Google and Microsoft.
2. Change the password. Long, unique, new.
3. Check forwarding rules. Settings, Forwarding, Rules. Delete anything you didn't create.
4. Turn on multi-factor authentication if it isn't on. App or passkey over a text message.

You stay in control the whole way through. That's rather the point.

---

Where this sits

The Australian Signals Directorate keeps a short list of the eight things that protect a business most. The Essential 8. Patching applications and patching operating systems are two of the eight, in as many words. Regular backups sit right beside them. The net, then the button. Same picture.

So no, I'm not going to tell you to protect the business because you're frightened. Fear has had twenty years and four hundred presses to work on you, and we've both seen the results. Protection is simply becoming part of what running a business means, the way the insurance certificate did, the way the food-safety sticker on the café wall did. A minimum, not an achievement. The world moved, quietly, the way it always does, and the way forward was never fear, and it was never luck. It's a net, a watchman, and a button that presses itself while you sleep.

The Ransomware Readiness Check answers what a quiet machine can't: which of your tomorrows actually matters, whether your net would hold, and, increasingly, what you say when a customer or an insurer asks. Thirty minutes, $149, less than most call-out fees, plain English, and no sales call afterwards. You finish with a score you can act on. Understand your exposure. Know what matters most. Find out, instead of wondering.

Or skip the list entirely. A WISECLICK membership is, at its core, a small team of people and systems whose entire job is to never press Remind Me Tomorrow on your behalf. Eyes on the machine, so the quiet is verified rather than assumed. And a net under everything, so that no button, pressed or unpressed, can ever cost you the business.

Somewhere in Australia tonight, the scanners will sweep past a few million door handles, the way they always do. After tonight's twelve minutes, one of the handles that doesn't turn will be yours. They won't even slow down. That's the whole idea.

Stay protected, my friends.
— The Most Secure Man Alive

---

Frequently asked questions

Nothing has ever happened to my business. Why would now be different?

Because your quiet run was arithmetic, not armour. Finding open doors was always automated; doing something with what was found used to take a person, and people went where the money was biggest. That follow-through is now automated and franchised too, which is why ASD's latest annual report counts a cybercrime report every six minutes, average small business losses of $56,600 (up 14 per cent in a year), and an 83 per cent jump in ASD warnings to businesses. Most machines will still be fine next week. But "it hasn't happened" is a record of the old odds, not a forecast of the new ones.

A client just sent me a security questionnaire. Is that normal now?

Increasingly, yes, and it will become more so. Larger businesses are being pushed to check their suppliers, insurers are asking about updates, backups and multi-factor authentication at renewal, and government work has asked for years. Being able to answer calmly, in writing, is becoming part of winning and keeping work. The Ransomware Readiness Check exists partly for exactly this moment.

What if an update breaks something?

Occasionally, one does. But it breaks loudly and in company: a million machines got the same update, so the problem gets a name, a thread and usually a fix within hours, and rollback exists in the meantime. The two-buttons rule (back up, then update) is why it can never be fatal. A known flaw left open breaks quietly, alone, and on a stranger's schedule.

How would I actually know if someone had access to my machine or accounts?

Often, not by feel. A quiet machine proves nothing either way. What you can check: the recent sign-in and device page on your email account, and your forwarding rules. Those answer tonight's version of the question. Continuous answers come from continuous watching, which is what monitoring tools exist to do.

Should I back up before updating?

Yes. The order is the whole trick. Once nothing can be lost by pressing the button, there's no reason left not to press it.

Is it safe to install software updates straight away, or should I wait a few days?

For a small business, the race usually outweighs the wait. ASD notes that code exploiting a published flaw can appear within 48 hours, sometimes 24. The net removes the reason to hesitate anyway.

Do phones and tablets count?

Completely. They hold your email, your banking and your codes. Automatic updates on, iPhone and Android both, overnight.

I'm on a Mac. Does any of this apply to me?

All of it. Apple publishes security notes with every macOS and iPhone update, listing the flaws each one fixes, and those notices enter the same race as everyone else's. The Mac's built-in protections are genuinely good, and they do their best work on the current version. Software Update, automatic, overnight.

Are update pop-ups ever fake?

Yes, and the tell is where they come from. Real prompts come from your system settings or the app itself. A webpage insisting you update something is an advertisement at best and a trap at worst. Close the browser, check the system's own update page. How convincing the fakes have become is a story for another Dispatch.

What does the Essential 8 say about updates?

Two of the eight strategies are patching applications and patching operating systems, applied promptly. A third, regular backups, is the net that makes the first two easy. Full guidance at cyber.gov.au.

---