A Synchronos vertical
Nothing breaks. The cameras keep working, the email keeps arriving, the invoices keep getting paid online. This page is about learning to both protect and create a safer space to store and constantly verify valuable day to day data.
For small businesses and the people who run them · October 2026
A property management office, eleven people, a typical day in October. Here is what came in. Read it the way the office manager did, between phone calls.
Exhibit · the day's paper, as it arrived (illustrative)
| Item | Amount | What it said |
|---|---|---|
| Invoice, Marlow Supply #4471 | $6,180.00 | Monthly maintenance supplies, net 30 |
| Email, Marlow Supply accounting | $38,400.00 | "We've moved banks. Updated remit-to attached. Please process #4472 today to avoid a late fee." |
| Card statement, October | $9,212.47 | Forty-one charges |
| Rental application, unit 3B | — | Two pay stubs, a bank statement, a driver's license |
| Service agreement, alarm vendor | $2,940.00/yr | Annual renewal, signature requested |
| Voicemail, "the bank's fraud department" | — | "Suspicious activity on your account. Call us back at this number to verify." |
| Firmware notice, lobby camera | — | Update available. Dismissed. |
Three of these were attacks. The email: the vendor had not moved banks; the account belonged to a money mule, and the real Marlow invoice #4472 arrived a week later. The application: the pay stubs were edited, and the year-to-date figures did not add up. The voicemail: the number went to the caller, not the bank. The camera notice was not an attack. It was the door the next one will use.
The office manager paid the $38,400. She was good at her job. The email had the vendor's logo, the right invoice number, and the right tone. There was nothing on the desk that told her to stop, because nothing on the desk had ever been told what the vendor's real account was.
The loss did not look like an attack. It felt like business as usual.
Most owners have never done this. The number is the lesson.
Fourteen connected things. Three updated this year. Every one on the same network as the computer that pays the bills. Dotted lines: what the router can reach, which is everything.
A camera is a computer with a lens. A thermostat is a computer with a dial. They were sold as convenience, with a password nobody changed and software nobody updates, and they sit on the same wire as the bookkeeper's machine. An attacker does not need to break into the office. The office is already inside out.
A compromised camera still shows the lobby. A compromised inbox still delivers mail. The office looks exactly as it did yesterday. That is the design.
The attack is an invoice, an application, a voicemail. People watch for hackers; the hacker is a PDF.
Nobody thinks of a doorbell as something with an operating system and a password. So nobody treats it like one.
Most intrusions are never reported and most victims never learn how they were hit. A business can run compromised for years.
Every connected thing made life easier. Nobody sold the open port that came with it.
Small businesses are taking up AI faster than any technology in memory, because it works. It is amazing. The same capability is now being used to write the invoice, edit the pay stub, and make the phone call, at no cost and in any volume.
In late 2026 the researchers who build these systems warned that small AI models may be months from copying themselves across internet-connected devices, with homes and small businesses as the likely first targets, and that there would be no central point to shut off. The office in the drawing above is what they were describing.
The hints are already becoming public. The hacks and losses will be disclosed the way they always are: afterward, in aggregate, and too late for the business that took the loss. Preparation cannot wait for the public disclosure.
Hacks are invisible until they aren't. By then the money is gone. The only defense is preparation and a copy of what was true before.
Rule one
No money moves to a changed or new bank account until someone has phoned the number already on file and heard a person confirm it.
Not the number on the new invoice. Not the number in the email. The one that was in your records before today. That single habit defeats the scheme behind most of the losses the FBI counts each year. Write it down, tell every person who can pay a bill, and put it on the wall.
Then the rest, in order: change the password on every connected thing and update it; keep a list of what is plugged in; verify any request marked urgent by a second channel; keep the records of what is true somewhere an outsider cannot reach. The last one is where a machine helps, because a person cannot remember every vendor's bank account. A machine can.
Many business used to have a safe. It kept what was inside from getting out, kept strangers from getting in, and opened only for the people who knew the combination. Bizdot is a safe for the facts, with one difference: it knows what belongs inside.
It is a sealed machine, no network hardware, that sits in your office and holds your record of what is true: who you pay and the accounts they really use, who may approve what, what your contracts say, what is plugged into the wall. The day's paper is carried fed by hand and read against that record. What matches is approved. What does not is held, with the page cited.
Exhibit · the same Tuesday, read against the record
| Item | Amount | Finding | Status |
|---|---|---|---|
| Invoice, Marlow Supply #4471 | $6,180.00 | Vendor, account and amount match the record | Matched |
| Email, "Marlow Supply" #4472 | $38,400.00 | Remit-to differs from the account on file; six times the largest prior invoice; urgency language | Held |
| Card statement, October | $9,212.47 | Every charge matched to a receipt or a known subscription | Matched |
| Application, unit 3B | — | Pay stub year-to-date does not reconcile across periods | Held |
| Service agreement, alarm vendor | $2,940.00/yr | Renews itself in 31 days unless cancelled in writing | Date |
| Voicemail, "fraud department" | — | Callback number not the bank's number on file | Held |
| Lobby camera | — | Update outstanding 94 days | Review |
Rows in red did not match the record. The machine lists them; it does not rank them, pay them or ignore them. The owner decides, and the sheet records who decided.
The rules it the device uses are the ones banks have used for decades, written down for a business with no compliance department, each one cited to its public source. The record is yours, built from your own records in the first month, with you or your bookkeeper as the answer key.
In red, the businesses with all three traits. Bizdot starts there.
What the machine will not do.
It will not pay an invoice, sign a contract, send an email or block a device. It lists what the your records says and where they disagree.
It will not connect to the internet, to your bank, to your accounting software or to anything outside the room. Statements and exports come in as files, carried by your staff.
It treats everything it reads as paper, never as instructions. A document that tells the machine what to do is a document the machine holds.
Nobody rents a safe from someone who keeps a key. You own this machine. It works through the night on its own hardware with no bill per page. If we disappear, nothing of yours moves. It earns its keep the first time it holds a wire to a changed account.
The house has the cameras and the smart TV. The parent gets the urgent call from "the bank." The tenant gets the email that the landlord's account has changed. Rule one is the same rule: phone the number you already had.
Everything on this page scales down to a kitchen table. Count what is plugged in. Change the passwords. Verify by a second channel. Keep the record of what is true where no one else can reach it, on paper if that is what you are comfortable with.
Two days in your office finding where money and documents move, who approves what, and what is plugged into the wall. You get the list whether or not you go further.
A month of your own invoices, statements and contracts become the known-good. Your bookkeeper is the answer key.
The machine reads twelve months of activity against the record. Anything it would have held, you see. Anything it missed, you see too.
Payments first, since that is where money leaves. Then the rest, one kind of paper at a time.
Everyone building this has run a small operation or lent to one. It is built with a business, not for one.
A small number of pilots beginning in 2027, one business and one region at a time. The field guide above is free to share with anyone who runs an office.
eric@synchronos.com