Ryan Flynn

Husband, dad | CEO, Network Services Group | Cybersecurity, compliance & safe AI | Arkansas |

[Ryan Flynn @rflynn_ryan]

Holiday shipping season means fake "your package is delayed" texts are about to hit every phone in your office.
The link asks for a small redelivery fee. What it really wants is a card number or a Microsoft 365 login.
Check tracking in the carrier's app, never the text.
#Cybersecurity #ArkansasBusiness

[Ryan Flynn @rflynn_ryan]

That AI note-taker that joins your Teams or Zoom calls? Before your team turns one on, know three things: who agreed to be recorded, where the transcript is stored, and who can read it. For clinics, law firms and CPAs, that's a confidentiality question, not a convenience one.

[Ryan Flynn @rflynn_ryan]

Arkansas CPA and tax firms: the FTC Safeguards Rule requires a written information security plan, and the IRS asks about it when you renew your PTIN.
If your plan is a template nobody has opened since it was downloaded, update it before tax season.
#Compliance #Cybersecurity

[Ryan Flynn @rflynn_ryan]

Passing MFA doesn't mean the attacker is locked out.
Token theft lets them reuse a session that already signed in. No password or code needed.
Watch for impossible-travel sign-ins and revoke sessions fast when something looks off.
#Cybersecurity #MSP

[Ryan Flynn @rflynn_ryan]

Before you turn on Copilot, check your file permissions.
AI doesn't break your sharing settings. It just finds everything they already expose, like payroll in a folder "everyone" can open.
Clean up access first, then roll out AI.
#SafeAI #Microsoft365

[Ryan Flynn @rflynn_ryan]

If a voice note or “quick call” sounds like your CEO asking for an urgent wire, pause.
Deepfakes are good enough that urgency + a familiar voice is the attack.
Verify out-of-band. No exception for “I’m in a meeting.”
#SafeAI #Cybersecurity

[Ryan Flynn @rflynn_ryan]

When a vendor asks for remote access “just for today,” treat it like a permanent door into your network.
Time-bound account. MFA. Logged session. Revoke the second the work is done.
#Cybersecurity #MSP

[Ryan Flynn @rflynn_ryan]

Before your team pastes a client contract or a patient note into a free AI tool, ask one question: where does that data go next? Safe AI starts with an approved tool list, not a ban. Pick the tools, set the rules, train the people. #AI #Cybersecurity #Arkansas

[Ryan Flynn @rflynn_ryan]

That AI notetaker on your Teams call now holds a transcript of everything said. Before you turn one on, know where it's stored, who can read it, how long it's kept, and whether the person on the other end agreed to be recorded. #SafeAI #Cybersecurity

[Ryan Flynn @rflynn_ryan]

CMMC Level 2 isn't a finish line.
You affirm every year, and the controls still have to be true on day 366.
Build it into how you run the business, not a project you close out.
#CMMC #Compliance

[Ryan Flynn @rflynn_ryan]

Standing admin rights are a quiet risk.
If someone doesn't need the keys every day, they shouldn't hold them every day.
Fewer accounts. Shorter access. Clear owners.
#CyberSecurity

[Ryan Flynn @rflynn_ryan]

Your team doesn't need a ban on AI.
They need a clear line: what client data can go into a tool, what stays out, and who owns the call when it's gray.
Rules beat hope.
#SafeAI #CyberSecurity

[Ryan Flynn @rflynn_ryan]

A compliance binder on a shelf isn’t a security program.

MFA, tested restores, and a real response plan beat a stack of policies nobody follows. Proof over theater.

[Ryan Flynn @rflynn_ryan]

A compliance binder nobody opens is theater. The real test is whether you can prove the control still works the day someone asks.

[Ryan Flynn @rflynn_ryan]

MFA isn’t optional anymore.

If a stolen password can open email, VPN, or finance tools, you’re one phish away from a bad week.

Turn it on everywhere that matters. Prefer an authenticator app over SMS when you can.

Basics beat buzzwords.

[Ryan Flynn @rflynn_ryan]

Most of the AI risk isn’t the model. It’s what people paste into it — customer lists, contracts, passwords. Set the ground rules before you scale.

[Ryan Flynn @rflynn_ryan]

AI tools are landing in every Arkansas office. The real question isn’t whether to use them — it’s who owns the data going in, and who can see what comes out. Get that clear before you scale.

[Ryan Flynn @rflynn_ryan]

Most “security programs” are a product logo and a hope.

Start with MFA, patching, and a restore you’ve actually tested. The boring controls beat the shiny ones.

#CyberSecurity #MSP

[Ryan Flynn @rflynn_ryan]

Nonprofits don’t need flashy IT. They need IT that stays out of the way.

At NSG we help Arkansas nonprofits keep systems secure and reliable — so budgets and energy stay on the mission.

(Same idea I shared with AY earlier this year.)

#Nonprofit #Arkansas

[Matthew Engler @MattEnglerDC]

@rflynn_ryan This. Primes don’t ask for your binder. They ask for the artifact that proves you did the control last Tuesday.