Use authoritative learning resources

Learning edition: 5 October 2026. Introductory learning material.

Continue learning from primary sources and your system providers. Select material that matches your role and the systems you use.

• NIST small-business framework resources: organize risk-management discussions.
• CISA small-business resources: practical awareness and technical starting points.
• NIST digital identity guidance: authentication-system requirements and rationale.
• FIDO Alliance passkeys: understand phishing-resistant authentication.
• PCI SSC merchant resources: payment-security questions and responsibilities.
• FTC Cybersecurity for Small Business: business-facing explanations and questions for providers.

Check publication dates, scope and current provider instructions. Reading a resource does not establish compliance.

For Colabmo resources, visit Industry Guides & Learning Resources. Contact us about course access or a defined project.

Keep learning useful

Bookmark the sources that support your action plan. Assign someone to check guidance when your systems or responsibilities change. Source links are further reading, not required product purchases. This edition's editorial review does not replace a system-specific technical assessment.

AI and newer deception techniques

These sources informed the 5 October 2026 update. Threat examples are not a ranking or a claim that every small business is being targeted.

• FBI: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud — 3 December 2024.
• ASD ACSC, NCSC NZ and COSBOA: Artificial intelligence for small business — 2025 edition.
• Microsoft: Think before you Click(Fix) — 21 August 2025.
• FBI: Consent phishing advisory — 1 September 2026.
• Microsoft: Inside an AI-enabled device code phishing campaign — 6 April 2026.
• NCSC: Prompt injection is not SQL injection — 8 December 2025.
• NCSC: Thinking carefully before adopting agentic AI — 15 May 2026.
• NCSC: The hidden risks of shadow AI — 7 September 2026.

Use the phishing and authentication lessons for suspicious requests; the sharing and AI security layers lessons for your own use of AI. Recheck vendor instructions before changing live systems.