u/i-am-entropyy

Posting this for the owners and operators here because the shape of business email compromise has changed enough that the old "watch the inbox" advice doesn't cover the actual attack anymore. This isn't a pitch.

LevelBlue logged more than 5,000 dual-channel BEC attempts in 2025. The opening email isn't trying to redirect a wire on its own anymore. About four in ten of the opening emails are just a polite request for a cell number or a personal email. Once the conversation moves to SMS (about 66% of these) or WhatsApp (about 32%), there's no corporate gateway watching it, and the rest of the social-engineering plays out across a few days on a channel nobody is logging.

The control that survives this shape change is the one you already know, just written down and enforced. Any wire change, any payment account update, any "urgent" instruction from a vendor or a customer gets verified on a phone number you saved before today. Not the number in the email. Not the number in the text. The number that was already in your contacts last week.

(Source: https://www.computerweekly.com/news/366637242/Dual-channel-attacks-are-the-new-face-of-BEC-in-2026)

Posting this for the SMB owners here because the numbers from the 2025 close-out reports are worth seeing in one place rather than absorbing piecemeal. Sources are linked at the bottom; this isn't a pitch.

- Ransomware attacks on small and midsize businesses grew 68% in 2025

- Average ransom demand is roughly $247,000

- Average downtime is 24 days, which is more than three weeks where you can't take new orders, run payroll cleanly, or access your accounting software

- 88% of all ransomware incidents involve businesses with fewer than 500 employees

- Total cost of an incident usually runs between $120K and $1.24M including recovery and lost revenue

The asymmetry is the core problem. A single affiliate operator on one of the modern ransomware crews can hit dozens of SMB targets in a quarter without breaking a sweat, while the average defender on the SMB side is one IT generalist or an MSP stretched across forty other clients.

The control set that actually moves the needle at SMB pricing is small. Phish-resistant MFA on every administrative account. An offline backup with a tested restore (the test is the part that matters). A written wire-and-payment-change procedure that doesn't depend on one person picking up the phone. That's most of the way to a non-catastrophic outcome.

(Sources: https://programs.com/resources/small-business-ransomware-stats/ and https://www.huntress.com/ransomware-guide/ransomware-attack-statistics)

INL announced last week that DOME (Demonstration of Microreactor Experiments) is complete and ready for occupancy. It's the first DOE-sited test bed where private developers can run an end-to-end fuel-load, operate, and decommission cycle inside an existing federal containment envelope, which collapses one of the longest poles on the demonstration timeline.

DOE conditionally selected Westinghouse and Radiant as the first two tenants. Both designs are also pilot-program candidates for the July 4 criticality target the Reactor Pilot Program is chasing across its 11 selected projects.

From the operational side, the interesting wrinkle is that the pilot program had a deadline but no shared physical infrastructure — every developer was on its own to find a containment structure, fueling capability, and decommissioning path. DOME removes that constraint for the first two tenants and creates a precedent for whatever comes after.

Curious from the operations side here whether the limited-fuel-form constraints in the existing envelope end up being the bottleneck, or whether siting and licensing remain the long pole even with DOME in place.

(Source: https://inl.gov/news-release/dome-worlds-first-nuclear-reactor-test-bed-ready-for-privately-developed-advanced-reactors/)

The NRC published a proposed rule last week (Part 57) creating a microreactor-only licensing track aimed at 6–12 month construction permit and operating license reviews, which is roughly an order of magnitude faster than the timelines the existing fleet sees today.

A few of the technical pieces that don't usually get airtime in the headlines:

- Scope is reactors at roughly 100 MWe and below

- Allows approval of fleets of identical reactors under a single design package

- Streamlines environmental review for low-impact projects

- Creates a pathway for limited construction ahead of permitting

- NRC's own cost-savings estimate is $3.76B to $11.84B across all parties

The rule was authored inside an Office of Advanced Reactors that doesn't formally stand up until midsummer, which is part of why the velocity is surprising people who were expecting the new office to slow things down rather than ship its highest-leverage rule before it officially exists. Federal Register publication is scheduled for May 6.

Curious what the operators and licensing folks here think about the limited-construction-ahead-of-permitting clause specifically, because that's the piece that meaningfully changes the project finance picture if it survives comment.

(Source: https://www.powermag.com/nrc-unveils-part-57-a-streamlined-path-for-high-volume-microreactor-licensing/)