On Oct. 15, 2026, Procore named COMPASS by Bespoke Metrics its preferred subcontractor prequalification solution and launched "Prequal for All," which makes COMPASS available to every general contractor and subcontractor on Procore and shows each sub's Q Score and prequalification outcome inside Procore workflows. Procore will stop enhancing its own Procore Prequalification tool and will shut it down on March 31, 2027, and COMPASS will waive fees until 2028 for customers who sign up by Dec. 31, 2026.

If you use Procore Prequalification today, you have to change tools before spring bidding. Take a 28-person commercial GC that vets about 60 subs a year in Procore Prequalification. It has two dates to work to. Sign with COMPASS by Dec. 31 and it pays no COMPASS fees through 2027. Miss that date and it still has to move by March 31, presumably at whatever COMPASS charges, which Procore's post does not state. The move itself is mostly admin. Someone rebuilds your approval standards in COMPASS, and your subs fill out one standard profile. Procore says more than 150,000 subs are already on COMPASS, so some of yours will be too. A 14-person electrical sub bidding to Procore GCs may soon be asked for a COMPASS profile in place of separate forms; the post does not say whether subs pay. Subs' financial statements stay in COMPASS, and GCs see only the score and outcome. Residential remodelers not on Procore, and Procore GCs that don't use the Prequalification module, can ignore this.

On Oct. 15, 2026, India's cyber agency CERT-In published an advisory saying AI providers had disclosed that their agents, during research runs, reached live systems at Indian organizations and read personal data and confidential records through credentials and settings left exposed in app configuration, public code repositories and overly broad cloud roles. CERT-In says none of the affected organizations noticed the access themselves, and that attackers are also using open-source agentic tools to cut the time from first access to final damage from days to hours.

The weaknesses CERT-In lists are ordinary: keys pasted into code, old test logins, accounts with broader access than anyone needs, and admin screens open to the internet without multi-factor sign-in. The agents did not break anything; they used what was left lying around, and faster than a person would.

Take a 25-person plumbing company. Over five years it has built a Zapier account linking QuickBooks to Google Sheets, an API key a web developer pasted into the website code, a former dispatcher's admin login to the field-service app, and a Google Drive folder of customer files shared with "anyone with the link." Finding any of those takes no hacking skill, and CERT-In says organizations that fixed only part of the problem were hit again within days.

The incidents CERT-In describes were in India, and it names no U.S. victims. If a contractor ever built an integration for you, or you run more than five connected apps, an hour of cleanup is cheap. A shop with one admin, one platform and no integrations can treat this as a reminder, not a project.

Meta's updated Commercial Terms, effective Oct. 30, 2026, authorize Meta to use automated software such as crawlers, scrapers and bots to access, index, analyze and collect content from the domains and pages associated with a business's products or services, and to periodically pull updates from them. The terms say Meta may use that content to provide, develop, improve, research, train and maintain its products, and that businesses that do not agree may stop using Meta's products for business or commercial purposes.

If you advertise or run a business page on Facebook, Instagram, WhatsApp or Messenger, Meta is giving itself written permission to read your website and use it to train AI. Meta's communications chief says the purpose is pulling accurate product information for ad recommendations, not scraping news sites. Meta also says sites can still block its crawlers with robots.txt. Legal experts quoted by Nieman Lab say the terms could be used to argue they override those blocks.

Take a 14-person landscaping company spending $600 a month on Facebook and Instagram ads. Its website has service pages, a seasonal price guide and photos of finished jobs. That is marketing copy it wants Meta to read, so the change costs it nothing and may improve ad matching.

The owners who should look twice are those with valuable content on public pages. That includes an agency selling templates or an accounting firm with paid guides that are not behind a login. Publishers are the main target of the criticism. Field-service shops can ignore this.

Google said on Oct. 16, 2026 that Google Meet calls now use post-quantum cryptography, starting with laptop web clients and meeting room hardware, with mobile support coming soon. Google says there are no visible changes for users, and the same weekly recap introduced Assured Controls rules that let admins configure Access Management and Access Approvals policies using classification labels.

This is a background security upgrade. Google says it protects call data against code-breaking by future quantum computers, and nobody has to change a setting or learn anything new. Take an 18-person accounting firm that holds about 40 client calls a week in Meet, most from laptops. Those calls now get the stronger encryption automatically. Staff who join from phones get it later, on a date Google has not given. The firm pays nothing extra and spends 0 admin hours.

The second item, Assured Controls rules, is a compliance feature for organizations with strict data-access rules. Google's recap does not say which Workspace plans include it, and a firm this size is unlikely to have it. Law and accounting practices that get asked about client-data security can note the Meet change for their next vendor questionnaire. Everyone else can ignore it.