How to Account for Accretion

3 min read

Whether it’s an individual investor or a business owner looking to increase their earning power, understanding how accretion works is essential for individual and business investors to make the correct decisions going forward.

How Accretion Works for Bonds

Accretion is the gradual increase of a bond’s value over time. As a bond moves toward its maturity date, it increases in value until it reaches its face or par value – or what’s paid to the bondholder upon maturity.

If a bond has a face value of $2,000, yet it’s discounted at $1,900 when it’s offered for sale, the present value of the bond is $1,900, leaving the difference of $100 as the discount. Between the time of purchase and when it matures, the value of the bond will appreciate, up to its par value of $2,000. As the bond increases in value, this is referred to as an accretion discount.

When it comes to accounting for bond accretion, there are two common methods.

Straight-Line Method

This approach documents the bond’s appreciated monetary gain and is laid out equally over the bond’s time frame until maturity. For a bond with a term of 10 years and a business that publishes its earnings once a quarter, there are 40 earnings releases.

If there’s a $100 discount, spread across 40 quarters, that is $2.50 every three months. The $2.50 is the quarterly accretion until the bond matures.

Constant Yield Method

This method is different from the straight-line method in that the bond’s value appreciation increases in value closer to the bond’s maturity date.

Acquisitions and Accretion

Companies can also benefit from accretion. Through the concept of synergy, where there’s more output from combining multiple entities than the sum of them if still separate, an acquiring company adds the earnings before interest, taxes, depreciation, and amortization (EBITDA), for example, to add to its existing shareholders’ value.

Illustrating How it Works

If Company X wants to increase its earnings per share for its shareholders, an acquisition is one way to do so. Assume Company X earned $1 million in net income the preceding year and has 3 million shares. And then there is Company Z, which had $500,000 in net income over the same time frame, with 1 million shares issued to raise cash. The following is a way to calculate the acquisition accretion value of the new combined company.

Earnings Per Share of Company X: 1,000,000 / 3,000,000 = 0.33

Earnings Per Share of the new company post-acquisition: ($1,000,000 + $500,000) / (3,000,000 + 1,000,000) = $1,500,000 / 4,000,000 = 0.375

Based on the calculation, the earnings per share of the post-acquisition company are $0.375. Compared to the EPS for the original, pre-acquisition Company X, the post-acquisition company is $0.045, resulting in a positive acquisition accretion.

Whether an individual investor is looking to see how bond accretion works or a company is looking at whether an acquisition makes business sense, understanding how accretion works is essential to ensure it’s accounted for properly.

The New Face of Phishing: Techniques, Targets and Prevention

4 min read

Phishing is a major threat that keeps evolving and has now become a sophisticated and costly cyber risk facing businesses of all sizes. Previously linked to malicious links in an email, phishing is now powered by AI, automation, and social engineering. The attacks have become harder to detect; they are faster to execute; and they can be very damaging if successful. With many business processes happening online – such as payments, approvals, and customer engagement – the attack surface has expanded, and so has the creativity of cybercriminals.

The Changing Landscape of Phishing

Modern phishing is unlike the previous suspicious and poorly written emails, and today cybercriminals are using AI tools to do many things, including:

Generate perfectly written and personalized messages – attackers can now easily analyze company websites, social media profiles, public reports, and employee profiles to clone the tone, style, and communication patterns. Messages appear legitimate when they reference recent projects or internal updates.
Generate deepfake audio and video – with readily available AI voice-cloning tools, a scammer can easily impersonate CEOs or CFOs and request urgent wire transfers or credential access.
Bypass MFA using real-time phishing kits – these kits mirror login screens of popular business tools such as Microsoft 365 or Google Workspace. An employee enters credentials and authentication codes into the fake page, giving attackers instant access.
Launch automated hyper-targeted attacks – with automation, criminals can target specific departments using tailored messages relevant to their daily tasks.

High-Value Targets Inside Organizations

Phishing attacks are no longer random but very strategic:

C-Suite executives – executives are prime targets due to their authority and access levels. If an executive is compromised, their inbox can be used to authorize payments or request sensitive data.
Financial teams – the accounts department faces fake invoice scams, fraudulent banking instructions, and impersonated vendor messages.
HR departments – attackers send fake resumes loaded with malware. They might also pose as job applicants to access employee data.
Remote and hybrid workers – these workers use shared Wi-Fi, personal devices, and unsupervised collaboration tools. This creates a wider entry point for attackers.
Customers and partners – attackers impersonate brands and trick customers into submitting payments or sensitive information through fake lookalike pages.
IT admins and system engineers are also valuable as they have privileged access.

Modern Phishing Techniques

Emails remain the dominant delivery method, but attackers have diversified to:

Quishing (QR Code Phishing)
QR codes are everywhere: on flyers, delivery packages, restaurant menus, conference badge,s and more. However, QR codes can lead to malicious sites or credential harvesting pages.
Search Engine Phishing or Malvertising
Fake ads appear above legitimate brands on search results that a user can click on –thinking it’s a legitimate link.
Browser-in-the-Browser Attacks
These are fake login pop-ups that replicate trusted login screens. An employee will enter their credentials, thinking it’s a legitimate site, and this goes straight to attackers.
OAuth Application Scams
Here, attackers don’t steal passwords. Instead, they trick users into granting access to a malicious app. Once the access is granted, the attacker has total access.
Deepfake Calls and Video Messages
These may come as high-pressure video calls or messages from an executive requesting urgent action, emergency payment, or private documents.
Fake Travel and Expense Scams
Taking advantage of corporate travel, attackers clone legit travel sites in order to steal credit card and employee information.

Prevention Strategies Every Business Must Adopt

Phishing is a problem that can’t be eliminated but can only be significantly reduced through a combination of technical measures and human risk management.

Prevention requires a combination of technology, processes, and people.

Build a Security-Aware Culture
Training must be continuous, engaging, and realistic. It should be conducted via simulation and scenario-based learning.
Strengthen Email Authentication
Implement modern AI-based email filtering tools to help detect anomalies that human eyes miss. Include identity verification protocols like DMARC, SPF, and DKIM to reduce spoofing attacks.
Adopt Zero Trust Security
Implement the “never trust, always verify” approach. Access should be limited, monitored, and timed out automatically. High-risk actions should trigger additional verification.
Secure Remote Work
Implement VPNs, approved devices, endpoint protection, encrypted storage, and clear policies.
Implement Multistep Verification for Financial Transactions
Require verbal confirmation or dual approvals for high-value transfers.
Monitor Vendors and Partners
Keep in mind, there is a sharp rise in supply-chain attacks. Regularly verify domains, emails, and communication from suppliers and partners.
Have an Incident Response Plan
Be ready with a response plan in case of a breach. Acting quickly will reduce potential losses.

Conclusion

Phishing has transitioned into a sophisticated threat targeting the core operations of a business. New phishing variants reveal how attackers continually evolve their techniques. With the right awareness, technology, and processes, organizations can significantly reduce exposure.

How to Account for Additional Paid-in-Capital (APIC)

3 min read

According to the May 2019 Financial Stability Report from the Board of Governors of the Federal Reserve System, there was more than $15 billion in outstanding commercial credit. While there are many ways companies can obtain funding, additional paid-in-capital (APIC) is one way to accomplish this goal.

Defining APIC

This term refers to the gap between a share’s par value and the distribution price. If an investor pays more than what the company sets for its IPO price offer, that is what determines APIC.

Defining Par Value

Par value is the initial offer price a publicly traded company decides to offer shares to investors during its initial public offering (IPO) on exchanges. Depending on the actual initial price for an IPO, it can be done for publicity reasons, to reduce litigation risks and to aid in improving shareholder return on investment.

Market Value

Based on how well a publicly traded company performs, this is the prevailing price that investors assign to the share price, which varies dynamically.

Determining APIC

Calculating APIC is done as follows:

APIC = (Issue Price – Par Value) x Number of Shares Acquired by Investors

If a company establishes a stock price of $2 per share, investors can decide to bid up each share price to $3 or $7 or $20 via their purchases. If there are 2 million shares outstanding selling for a total of $44 million, the excess of $40 million (beyond the $4 million in par value) is the APIC.

Based on these circumstances, a company’s balance sheet should have the following entries:

– $4 million (paid-in-capital)

– $40 million (additional paid-in-capital)

When accounting for these stock purchases in this scenario, APIC is recorded on the balance sheet under the shareholder equity (SE) section. This can be seen as increasing a company’s bottom line because it results in them receiving additional cash from stockholders.

When it comes to recording the journal entry, the total cash generated by the IPO is recorded as an asset (debit) on the balance sheet, while the common stock and APIC are recorded as equity (credits).

Utility

The utility metric can yield a considerable amount of a business’ share capital, prior to retained earnings starting to accumulate. It helps provide a financial cushion for the company if retained earnings demonstrate a shortfall.

Companies that issue shares permit the business to not increase its fixed costs. Since this method is chosen instead of issuing bonds, there are no interest payments due to buyers of the bonds. Investors are not due any payments, including no dividend obligations. Business assets are also not subject to investor claims. Once shares are issued to investors, the generated funds are non-restricted, so the company can direct the funds as necessary.

APIC lets businesses produce money without any required assets backing the transaction. Depending on the company’s future performance, buying stock at the IPO can generate massive returns.

Further considerations

When there are additional share offerings post IPO, either common or preferred shares, the APIC levels may grow, necessitating them to be documented on the business’s financial statements. If share repurchases are made, levels can be decreased.

While each business has many options to raise money, if a company uses this method, it’s important to ensure that they are accounted for properly. As always, contact a professional to ensure the best personalized advice.

New Rules for Inherited Traditional IRA Distributions

3 min read

The rules for IRAs inherited after 2020 changed when Congress passed the Secure Act in 2019. The new rules eliminated the opportunity for non-spousal beneficiaries to “stretch” inherited IRA earnings over their own lifetime. Up until this year, required minimum distributions (RMDs) and associated penalties were waived while the IRS clarified the new rules; but in 2025, they are in full force for most inherited IRA beneficiaries.

For clarity: Non-spouses who inherited IRA assets after 2020 MUST take RMDs starting this year.

RMD Rules For Non-Spouses

For Traditional IRAs inherited after 2020, the first thing a non-spousal beneficiary must do is transfer the inherited assets into an inherited IRA under his own name. Note that RMDs are then required only if the original owner had reached their RMD age before dying. Under this scenario, the beneficiary must take required minimum distributions going forward, including any RMD not taken in the year the original IRA owner died. Over the next nine years, the new inherited IRA owner must take annual RMDs based on his own life expectancy and deplete the account within 10 years of the decedent’s death.

However, if the original account owner was NOT required to take minimum distributions as of the time he passed, the inherited IRA beneficiary is NOT required to take them – unless he reaches RMD age during the 10-year holding period(starting at age 73, or age 75 effective 2033). Either way, he still must empty the account and pay the requisite tax bill within 10 years of the original account owner’s death.

In addition to paying taxes owed on RMDs, inherited account owners are subject to a 25 percent penalty on any amount shy of that year’s required distribution. Should you miss an RMD, you may be able to reduce the penalty to 10 percent if the correct distribution is taken within two years.

RMD Rules For Spouse Beneficiaries

A spousal beneficiary of the original IRA owner has more options than a non-spouse. For starters, she can retain the original account under her own name. Similar to the non-spouse beneficiary, if the decedent spouse HAD reached his RMD age, the surviving spouse must take required minimum distributions as well, including any RMD not taken in the year the original owner died. However, RMDs thereafter will be calculated based on the surviving spouse’s life expectancy, and there is no requirement to deplete the account within 10 years.

If the original IRA owner had?NOT?started taking RMDs, then the spouse does not have to take RMDs until she reaches the age required to do so. At that point, the RMDs will be based on her own life expectancy.

A spousal beneficiary also has the option to transfer the inherited assets into her own IRA. Under this scenario, her RMD schedule is based on her own age. This option allows her to delay taking RMDs until she reaches RMD age, regardless of the RMD status of the deceased spouse. This strategy provides the opportunity for the inherited assets to grow longer, tax-deferred.

For clarity: the 10-year rule for full distribution does not apply to spouses.

Note that the rules discussed herein do not apply to Traditional IRAs inherited by Trusts or “Eligible Designated Beneficiaries” (EDBs), which refer to chronically ill or disabled beneficiaries, beneficiaries who are younger than the deceased account owner by 10 years or less, or minor children of the account owner.

It’s best to work with a financial advisor or IRA account custodian to choose the option best suited to your circumstances – and ensure you adhere to the appropriate rules.

The Hidden Tax Trap Keeping America’s Housing Market Frozen

4 min read

America’s housing crisis has reached a breaking point. With median home prices soaring past $400,000, the National Association of Home Builders reports that 60 percent of U.S. households can’t even afford a $300,000 home. The math has become impossible for most American families.

While we often blame high mortgage rates, restrictive zoning laws and rising construction costs for the housing shortage, there’s another culprit hiding in plain sight: a decades-old tax rule that’s trapping millions of homeowners in houses they’d rather leave.

The $500,000 Problem

When Congress overhauled capital gains taxes on home sales in 1997, they created what seemed like a generous benefit: homeowners could exclude up to $250,000 in profits from taxes ($500,000 for married couples) when selling their primary residence. This replaced a complex system of rollovers and age-based exemptions with something simpler and cleaner.

But Congress made one critical mistake – they never adjusted these limits for inflation or housing price growth.

Nearly three decades later, these same dollar amounts remain frozen in time, even as home values have skyrocketed. According to new research from Moody’s Analytics, if the exclusion had kept pace with home prices, it would now stand at $885,000 for singles and $1,775,000 for couples. Even adjusting for general inflation alone would double today’s limits.

The Senior Squeeze

This outdated tax rule hits empty-nesters particularly hard. Consider this: nearly 6 million households headed by seniors live in homes larger than 2,500 square feet. Many would gladly downsize to something more manageable, but selling could trigger six-figure tax bills on homes they’ve owned for decades.

The result? They stay put, waiting until death when their heirs can inherit the property with a stepped-up basis that erases all capital gains. Meanwhile, these oversized homes remain off the market, unavailable to growing families who desperately need the space.

Moody’s Analytics estimates these “overhoused” seniors spend $3,000 to $5,000 more annually on maintenance, utilities and property taxes than they would in smaller homes – adding up to $20 billion to 30 billion in unnecessary costs nationwide each year.

An Unexpected Burden on the Middle Class

Surprisingly, this tax burden doesn’t primarily affect the wealthy. Middle-class homeowners in expensive markets like California and Massachusetts face steep tax bills despite modest incomes. Widows face their own challenges, having just two years after a spouse’s death to sell while maintaining the full $500,000 exclusion (though they do receive a partial step-up in basis on their late spouse’s share).

An IRS study revealed a startling fact: 20 percent to 25 percent of capital gains taxes collected under current rules come from filers earning less than $20,000 annually. Meanwhile, wealthier homeowners often have the resources and flexibility to structure sales strategically, minimizing their tax exposure.

The Housing Market Ripple Effect

This tax trap creates a cascade of problems. Young families remain stuck in starter homes. First-time buyers face even fiercer competition for limited inventory. Labor mobility suffers as workers can’t relocate to areas with better job opportunities. The entire housing ecosystem becomes frozen.

The shortage is stark: monthly active listings only climbed back above 1 million in May, according to realtor.com. Before the pandemic, that number hadn’t dropped below that threshold since at least 2016.

Solutions on the Table

Congress is considering two approaches to break this logjam. One would be to double the current exclusions and index them to inflation going forward. The more radical proposal would eliminate the cap entirely.

The Double-Edged Sword

Any change comes with risks. Moody’s Analytics warns that while updating these limits could unlock hundreds of thousands of homes and boost inventory, it might also intensify competition at the lower end of the market as downsizing seniors compete with first-time buyers for the same properties. It could also make housing an even more attractive tax shelter, which would ultimately drive prices higher.

The Path Forward

The paradox is clear: raising or eliminating the capital gains exclusion could provide immediate relief to millions of homeowners trapped by tax considerations. It could inject a much-needed supply into a starved market. But without careful implementation, it could just as easily fuel another round of price increases, leaving affordability as elusive as ever.

Understanding The Q Ratio

3 min read

When it comes to evaluating a business, there are many ways to perform a valuation. One way to do so is to use the Q Ratio. Known as Tobin’s Q Ratio or simply the Q Ratio, this method looks at the proportion between the values of a physical asset and its replacement cost. Developed by Nobel laureate economist James Tobin, this ratio presumes a single company; for public investors, if asset values can be estimated, the company’s market value of a publicly traded company may be approximately estimated.

The original formula is as follows:

Q Ratio = Market Value of Assets / Replacement Cost of Capital

While this formula is the original iteration, approximating an asset’s replacement value is complicated and oftentimes not 100 percent realistic to analyze. The more realistic way it’s calculated is by using book values in lieu of the asset’s replacement costs. The new way to calculate it is as follows:

Q Ratio = (Equity Market Value + Liabilities’ Market Value) / (Equity Book Value + Liabilities’ Market Value)

When it comes to calculating the overall market’s Q Ratio:

Q Ratio = Value of the Stock Market / Corporate Net Worth

Putting the Q Ratio in Practice

Essentially, it’s used to value a company. Once calculated, the Q Ratio provides internal stakeholders and outside investors with one way to evaluate a company.

Above 1

If the Q Ratio is more than 1, the business’ market value is higher than its booked assets. It means a company’s valuation is overestimated in the eyes of the market since there is some portion of the company’s assets that are either not documented or valued fully. When the Q Ratio is above 1, a business’ earnings are worth more than replacement costs for the assets. At this level, entrepreneurs are incentivized to develop a competitor business to gain market share and financial gain.

Equal to 1

When the Q Ratio equals 1, it implies the market sees the company’s assets as valued fairly.

Below 1

At this level, a business’ assets are worth more than fair market value, establishing the business as undervalued. Investors with enough assets can purchase the company in question, either via shares if publicly traded or outright if a private company, versus trying to create a competitor company to siphon value away from it.

Further Consideration

When it comes to the calculated Q Ratio, it’s important to keep it in context. While accountants can be precise with many things during preparation, when it comes to market forces and intangible assets, analysts need to use their judgment. Investors and market forces can create hyperbole for a business’ value that can’t be quantified and recorded by accountants. Stock analysts’ perspectives on a business’ prospects or rumors regarding future performance can modulate the present, dynamic valuation of the company.

Another consideration is how to document and gauge intangible assets like intellectual property and goodwill. While accountants can approximate IP or goodwill, it’s not an exact science.

Thus, when businesses use the Q Ratio to value their own company or one they consider purchasing, investors must take the Q Ratio as part of a holistic valuation approach.

Financing Via Off-Balance Sheet Options

3 min read

When it comes to business needs, securing financing is a top priority, particularly when starting out or for ongoing needs such as making payroll or paying for inventory. This financing could include a loan or securing an ongoing credit line, and businesses can do that through Off-Balance Sheet Financing (OBSF).

Defining OBSF

Off-Balance Sheet Financing is an accounting practice whereby businesses document liabilities or assets on their books but do not reflect them on their balance sheet. It’s important to note that while they’re not reflected on the business’ balance sheet, if their disclosure meets generally accepted accounting principles (GAAP), it’s legal. If select transactions aren’t on the company’s balance sheet, these transactions are generally found in a company’s financial statements via notes. If, however, company employees conceal material information from investors, then it becomes illegal. As the Federal Deposit Insurance Corporation (FDIC) and the U.S. Securities and Exchange Commission (SEC) lay out, financial statements also may contain references to lease expenses, rentals, or partnerships.

Why Companies Use OBSF

Businesses use this type of accounting to manage their debt usage. Along with reducing interest rates for commercial loans, businesses can lower their leverage and debt-to-equity ratios, reducing the chances of default and encouraging outside investment. This is even more advantageous to help companies obtain financing if they have debt covenants.

In reaction to the Financial Accounting Standards Board’s (FASB) discovery of operating leases regarding OBSF of more than $1.25 trillion for lease accounting, it changed the requirement for OBSF in February 2016 to mandate U.S. public companies to record “right-of-use assets and liabilities from leases on balance sheets” per 2016-02 ASC 842, coming into force in 2019. Based on the publication “Accounting Standards Update No 2016-02 Leases (Topic 842) p. 1,” footnotes were mandated for greater transparency.

How OBSF Works

OBSF moves select assets, liabilities, or transactions away from their balance sheets. It’s done to attract investors or when a company has a ton of debt yet needs to borrow additional capital to fund operations. This can provide companies with more favorable lending rates. Such transactions are either moved to subsidiaries or via special purpose vehicles. The questionable assets are still there but are simply listed on related monetary documentation.

Depending on how the company proceeds, it can include entities that the parent company has a minority ownership stake in. This may include special purpose vehicles (SPV) that take on assets and liabilities, along with other entities such as joint ventures and research and development (R&D) partnerships.

Conclusion

When it comes to R&D partnerships, since R&D is capital-intensive and requires a long time for completion, OBSF is financially advantageous. It permits a company to reduce its liability over the research time since there are no substantive assets to help even out the liability. Industries such as healthcare can see benefits.

Another advantage of OBSF is that when an operating lease is used, it can create liquidity since capital is not tied up in purchasing equipment, and rental expenses are the only financial outflows.

When done according to GAAP guidelines and state and federal laws, companies that use OBSF can maximize their financial landscape.

Why Authorization Sprawl Is the Next Big Security Blind Spot and How to Fix It

4 min read

Despite major investments in cybersecurity, organizations continue to face breaches. Most security mechanisms implemented guard against threats such as password theft. However, there is a growing concern with the unchecked expansion of user access, permissions, and tokens across apps, clouds, and systems.

This growing challenge is known as authorization sprawl, and it is becoming one of the most dangerous and least visible threats in modern enterprise security.

SANS keynote at the RSAC 2025 Conference, attackers are increasingly exploiting this sprawl to gain legitimate, persistent access that bypasses multifactor authentication (MFA), security information and event management (SIEM) alerts, and endpoint detection and response (EDR) visibility altogether.

What is Authorization Sprawl?

Authorization sprawl occurs when access permissions multiply uncontrollably across systems, users, and applications. Every time a team or department adds a new SaaS integration, service account, or API key, another layer of permission is introduced.

In an attempt to make access to multiple applications easy, users also have single sign-on (SSO), designed to help log in once and access multiple applications securely. Here, users are granted access to several connected systems through SSO, adding to the authorization sprawl problem.

Over time, all these factors create a complex ecosystem that even security teams have a hard time tracing who can access what.

Unlike authentication, which verifies who someone is, authorization determines what one can do. When permissions expand without review, attackers take advantage of forgotten tokens, dormant accounts, or outdated roles to move freely inside systems.

Why Traditional Defenses Miss It

Most defenses focus on identity verification, such as MFA, conditional access, and endpoint protection. But once a user is authenticated, there is no monitoring. This is the blind spot that attackers exploit. Instead of breaking in, they log in using legitimate session tokens, application programming interface (API) keys, or open authorization (OAuth) grants.

The misuse of valid credentials or access tokens enables cloud-related breaches. These attacks bypass traditional detection tools because they appear to be normal activity by authorized users.

A recent incident involving Salesloft’s Drift application highlights how damaging authorization sprawl can be. Drift, an AI chatbot often integrated with Salesforce, was exploited after attackers gained access to Salesloft’s GitHub account and later its AWS environment. From there, they stole OAuth tokens and authentication credentials, exposing Salesforce data from potentially hundreds of organizations. This incident is an example of how interconnected SaaS systems and unchecked authorization links can create a cascading breach effect, where one weak point leads to multiple breaches across services.

The Business Impact of Authorization Sprawl

Aside from increasing technical risk, authorization sprawl erodes compliance, governance, and trust.

Regulatory Exposure – Frameworks like GDPR, SOC 2, and HIPAA require strict access control and auditability. Untracked permissions make demonstrating compliance nearly impossible.
Operational Risk – An overprivileged account can unintentionally leak data, delete configurations, or expose APIs.
False Sense of Security – Zero Trust frameworks often stop at identity verification. Failing to continuously validate authorization is equivalent to protecting the front door while leaving internal doors wide open.

How to Fix Authorization Sprawl

Luckily, solving this problem does not require removing existing security controls but rather extending visibility and discipline into authorization.

Conduct Regular Access Audits – Map users, roles, and permissions across your environment. Be sure to look for redundant privileges, dormant accounts, and orphaned API keys. Use tools that help visualize hidden paths and privilege escalation routes.
Implement Structured Access Control – Use frameworks like role-based access control (RBAC) or attribute-based access control (ABAC). Standardizing roles ensures fewer exceptions and easier auditing.
Automate Reviews and Revocations – Integrate identity and access management (IAM) with HR systems so access automatically changes when employees leave or change roles. This helps eliminate the temporary access that never gets removed.
Shorten Token Lifetimes and Rotate Credentials – Session tokens and personal access tokens (PATs) should have an expiration period, such as 30 to 90 days. Using automated key rotation policies will help prevent long-lived access tokens from becoming backdoors.
Enforce the Principle of Least Privilege – Grant users and systems only the minimum access needed.
Extend Zero Trust to Authorization – Verification shouldn’t end with login. Apply continuous authorization checks.

Conclusion

As cloud ecosystems, APIs, and integrations continue to multiply, authorization complexity will grow exponentially. Businesses that invest in mapping and controlling authorization sprawl will stay ahead of both attackers and regulators. In cybersecurity, visibility equals control, and this begins with knowing exactly who can do what.

Powell CPA PLLC

Why Authorization Sprawl Is the Next Big Security Blind Spot and How to Fix It

November 1, 2025 · Blog, What's New in Technology

4 min read

Authorization Sprawl, What is Authorization Sprawl Despite major investments in cybersecurity, organizations continue to face breaches. Most security mechanisms implemented guard against threats such as password theft. However, there is a growing concern with the unchecked expansion of user access, permissions, and tokens across apps, clouds, and systems.

This growing challenge is known as authorization sprawl, and it is becoming one of the most dangerous and least visible threats in modern enterprise security.

According to insights from the SANS keynote at the RSAC 2025 Conference, attackers are increasingly exploiting this sprawl to gain legitimate, persistent access that bypasses multifactor authentication (MFA), security information and event management (SIEM) alerts, and endpoint detection and response (EDR) visibility altogether.

What is Authorization Sprawl?

Over time, all these factors create a complex ecosystem that even security teams have a hard time tracing who can access what.

Why Traditional Defenses Miss It

The misuse of valid credentials or access tokens enables cloud-related breaches. These attacks bypass traditional detection tools because they appear to be normal activity by authorized users.

The Business Impact of Authorization Sprawl

Aside from increasing technical risk, authorization sprawl erodes compliance, governance, and trust.

Regulatory Exposure – Frameworks like GDPR, SOC 2, and HIPAA require strict access control and auditability. Untracked permissions make demonstrating compliance nearly impossible.
Operational Risk – An overprivileged account can unintentionally leak data, delete configurations, or expose APIs.
False Sense of Security – Zero Trust frameworks often stop at identity verification. Failing to continuously validate authorization is equivalent to protecting the front door while leaving internal doors wide open.

How to Fix Authorization Sprawl

Luckily, solving this problem does not require removing existing security controls but rather extending visibility and discipline into authorization.

Conduct Regular Access Audits – Map users, roles, and permissions across your environment. Be sure to look for redundant privileges, dormant accounts, and orphaned API keys. Use tools that help visualize hidden paths and privilege escalation routes.
Implement Structured Access Control – Use frameworks like role-based access control (RBAC) or attribute-based access control (ABAC). Standardizing roles ensures fewer exceptions and easier auditing.
Automate Reviews and Revocations – Integrate identity and access management (IAM) with HR systems so access automatically changes when employees leave or change roles. This helps eliminate the temporary access that never gets removed.
Shorten Token Lifetimes and Rotate Credentials – Session tokens and personal access tokens (PATs) should have an expiration period, such as 30 to 90 days. Using automated key rotation policies will help prevent long-lived access tokens from becoming backdoors.
Enforce the Principle of Least Privilege – Grant users and systems only the minimum access needed.
Extend Zero Trust to Authorization – Verification shouldn’t end with login. Apply continuous authorization checks.

Conclusion

Disclaimer

Controversial Defense Funding Bill, Shoring Up ESOP Plans, and Leave Benefits for Public Health Personnel

3 min read

National Defense Authorization Act for Fiscal Year 2026 (S 2296) – Introduced by Sen. Roger Wicker (R-MS) on July 15, the Senate passed this legislation on Oct. 9. The bill is a carve-out of the 2026 budget bill intended to fund military appropriations for the 2025-2026 fiscal year. The bill was largely supported by Republicans but less so by Democrats, who are in favor of keeping the government closed until all of their budget concerns are addressed. In addition to establishing funding and policies for military and defense-related activities, the bill includes a roadmap for bomber modernization, a real-time database for contractor compliance oversight, and authorizing programs for nuclear weapons facilities. The legislation would authorize $32.1 billion over the President’s budget request, and the White House opposes provisions in the bill that thwart the President’s ability to control immigration and conduct foreign affairs, including submitting plans to Congress ahead of actions, dictating the terms of intelligence support to Ukraine, and enabling the Defense Department to bypass the Administration’s tariffs. The bill currently rests with the House, which asserts it will not return to regular session until the Senate passes the current controversial CR budget bill.

Employee Ownership Representation Act of 2025 (S 1728) – This bipartisan bill seeks to expand the membership of the Advisory Council on Employee Welfare and Pension Benefit Plans to include two representatives of employee ownership organizations. While the council presently includes 15 members from business, labor, and the public, the council has no expertise specific to Employee Stock Ownership Plans (ESOPs). The legislation was introduced by Sen. Bill Cassidy (R-LA) on May 13 and passed in the Senate on Oct. 9. It currently awaits consideration by the House.

Retire Through Ownership Act (S 2403) – The main purpose of this bill is to provide a clear definition for certain closely held stock that aligns valuations with IRS standards in an effort to mitigate valuation risk for ESOPs. It would also provide “safe harbor” for trustees relying on these guidelines. The Act was introduced by Sen. Roger Marshall (R-KS) on July 23. It passed in the Senate on Oct. 9 and currently lies with the House.

Uniformed Services Leave Parity Act (S 1440) – Introduced by Sen. Tammy Duckworth (D-IL) on April 10, this legislation would authorize leave benefits (parental leave, emergency leave) to Public Health Service (PHS) officers. The bill sponsors assert that the current lack of these important benefits is a challenge to recruiting and retaining PHS personnel, who should be on par with the same benefits offered to uniformed service members. The bill passed in the Senate on Oct. 9 and is up for review in the House.

Internal Revenue Service Math and Taxpayer Help Act (HR 998) – This bill was introduced on Feb. 5 by Rep. Randy Feenstra (R-IA). Among other provisions, it instructs the IRS to provide taxpayers with details of notices that relate to a math or clerical error. The bill passed in the House on March 31 and in the Senate on Oct. 20. It currently awaits the President’s signature to become law.

Get a Jump on Holiday Shopping: Key November Dates

3 min read

For some of us, last-minute holiday shopping is just what we do. That said, it’s probably never fun, and two things invariably seem to happen: The gifts you want aren’t available, and you end up paying too much. That’s why shopping in November to get the best savings on what you want just might be the right thing to do this year. Here are a few sales dates to put on your calendar.

Singles Day, November 11. Originally started in China as a humorous “anti-Valentine’s Day” event, it’s become one of the biggest shopping days of the year, surpassing Black Friday and Cyber Monday. To top it off, the date, 11/11, was chosen because it symbolizes, you guessed it, four ones – aka singles. On this day, you can find huge discounts at a lot of high-end clothing stores like Athleta, Nordstrom, Lululemon, Abercrombie & Fitch, Madewell, Neiman-Marcus, and J. Crew, to name a few.

here.

Black Friday, November 28. It’s probably the most famous shopping day of the year, where you’ll find huge price cuts across all categories. If you’re into tech stuff, head to Apple, AT&T Wireless, Dell, Google, HP, Lenovo, or Micro Center to start. The big box places to hit are Walmart, Target, and Sam’s Club. For home goods, you’ll find savings at Bed, Bath & Beyond, Ashley Furniture, and Crate & Barrel. If you want a comprehensive list, go to blackfriday.com. (See? There’s even a website dedicated to this day!) But get ready to scroll because there’s a lot there.

Small Business Saturday, November 29. Originally launched in 2010 by American Express, this day is all about shopping at your local stores. So hit your neighborhood shops, markets, coffee shops, and boutiques to support your friends and neighbors. If you don’t know where to start and don’t have a lot of time, just Google “small business Saturday sales near me” and you’ll be good to go.

Cyber Monday, December 1. To cap off all the November savings, you can’t forget this day. And yes, it’s not technically in November, but that’s OK. This date is great because you can let your fingers do the shopping. Online-only offers are king, so hunker down and start searching. Some places with the biggest deals are, again, (and not surprisingly) Amazon, Target, and Walmart – the big three. For more price-cutting goodness, go here.

Life gets busy around this time of year, but if you take a moment, get your list and hit a few of the aforementioned stores, you’ll be way ahead come the holidays. And that just might be the best gift of all.

Sources

Holiday Shopping Calendar: Key Discount Dates 2025 | GiftList Blog | GiftList

https://giftlist.com/blog/holiday-shopping-calendar-key-discount-dates-2025

Powell CPA PLLC

Get a Jump on Holiday Shopping: Key November Dates

November 1, 2025 · Blog, Tip of the Month

3 min read

Pre-Black Friday, November 20-27. Yes, there is such a thing, as if Black Friday isn’t enough in and of itself. Nevertheless, lots of retailers get in on this. This year, you’ll want to check out early access on holiday deals at Costco, Lowe’s, Best Buy, as well as Kohl’s, GameStop, and PetSmart. You can find other merchants who offer deep discounts here.

Sources

Holiday Shopping Calendar: Key Discount Dates 2025 | GiftList Blog | GiftList

https://giftlist.com/blog/holiday-shopping-calendar-key-discount-dates-2025

Disclaimer

Powell CPA PLLC

How to Account for Accretion

Powell CPA PLLC

The New Face of Phishing: Techniques, Targets and Prevention

Powell CPA PLLC

How to Account for Additional Paid-in-Capital (APIC)

Powell CPA PLLC

New Rules for Inherited Traditional IRA Distributions

Powell CPA PLLC

The Hidden Tax Trap Keeping America’s Housing Market Frozen

Powell CPA PLLC

Understanding The Q Ratio

Powell CPA PLLC

Financing Via Off-Balance Sheet Options

Powell CPA PLLC

Why Authorization Sprawl Is the Next Big Security Blind Spot and How to Fix It

Powell CPA PLLC

Controversial Defense Funding Bill, Shoring Up ESOP Plans, and Leave Benefits for Public Health Personnel

Powell CPA PLLC

Get a Jump on Holiday Shopping: Key November Dates

Author: Service2Client

How to Account for Accretion

The New Face of Phishing: Techniques, Targets and Prevention

How to Account for Additional Paid-in-Capital (APIC)

New Rules for Inherited Traditional IRA Distributions

The Hidden Tax Trap Keeping America’s Housing Market Frozen

Understanding The Q Ratio

Financing Via Off-Balance Sheet Options

Why Authorization Sprawl Is the Next Big Security Blind Spot and How to Fix It

Controversial Defense Funding Bill, Shoring Up ESOP Plans, and Leave Benefits for Public Health Personnel

Get a Jump on Holiday Shopping: Key November Dates

Client Login

HOURS

CONTACT