Sunbird has relaunched its iMessage app for Android users nearly three years after security issues forced the company to pause the service in 2023.
The app is now available on the Google Play Store and allows Android users to access iMessage conversations, including blue-bubble messages and group chats with iPhone users. Sunbird has also combined iMessage with Google Messages, RCS and SMS/MMS in the same application.
The company says the new version has been rebuilt with changes to how messages, Apple ID credentials and media are handled. Sunbird claims messages are encrypted on the Android device before they leave it, protected while travelling through its infrastructure and encrypted at rest using AES-256. It also says Apple ID passwords are used once to establish an iMessage session and then deleted.
The relaunch comes after researchers identified serious security problems in Sunbird's earlier implementation, including the transmission of Apple ID credentials over an unencrypted HTTP connection and access to messages and media stored through Firebase. Those findings led to the removal of Nothing Chats, an iMessage app developed by Nothing using Sunbird's technology, and Sunbird subsequently paused its own service.
Sunbird returns to the Google Play Store
Sunbird Messaging announced on August 5 that its Android application was open to all users through Google Play following an early-access period. The company said more than 181,000 people had signed up before the public launch.
The application is designed to allow Android users to participate in iMessage conversations without owning an iPhone, Mac or another Apple device. Sunbird says users can appear in blue-bubble conversations on iPhones and participate in iMessage group chats through the Android application.
The new app also acts as a unified messaging platform. Instead of limiting the application to iMessage, Sunbird has brought iMessage, Google Messages through RCS and SMS/MMS into one inbox.
The application now includes a Primary and Secondary inbox. Sunbird says the Primary section is intended for important conversations, while less important messages can be placed in Secondary. Users can control how their conversations are organised.
The company has also said it plans to add WhatsApp and Facebook Messenger support later in 2026.
The service is available with a 14-day free trial, after which Sunbird charges $2.99 per month or $24.99 annually.
What happened to Sunbird in 2023
Sunbird's return follows a security incident that brought its earlier service offline in November 2023.
The issue became widely known after Nothing announced Nothing Chats, an Android application that used Sunbird's technology to provide iMessage functionality on the Nothing Phone (2). Users were required to provide their Apple ID credentials to connect the service to iMessage.
Security researchers then examined the application and identified several problems with how the service handled authentication and user data.
One of the issues involved Apple ID credentials being transmitted to Sunbird's servers over HTTP. Because HTTP does not encrypt the connection, the credentials could potentially be intercepted while being transmitted.
Researchers also found that messages and other user data were being sent to and stored through Firebase without encryption. An investigation by 9to5Google found that researchers could use insecurely transmitted JSON Web Tokens to access Sunbird's Firebase database and view messages and files belonging to users.
The exposed information was not limited to text messages.
Researchers reported that the database contained media files including images, videos, PDFs and audio files. More than 630,000 media files were reportedly stored through Sunbird's Firebase infrastructure at the time. Researchers also found vCards containing information such as names, phone numbers and email addresses.
The problem also involved Sentry, an error-monitoring service. Researchers reported that messages and attachments were being sent to Sentry in plaintext, meaning information intended to be part of private conversations could appear in an error-reporting system.
These findings conflicted with Sunbird and Nothing's earlier statements about encryption. The companies had presented the service as providing end-to-end encryption, but researchers found that data could be accessed through the systems supporting the application.
Nothing removed Nothing Chats from the Google Play Store less than 24 hours after its launch. The company said it was delaying the application while working with Sunbird to address the security problems. Sunbird also paused its own service shortly afterward.
Sunbird says the new architecture handles data differently
For the relaunched application, Sunbird says it has changed how messages and authentication information are processed.
According to the company's security documentation, messages are encrypted on the user's phone before they leave the device. The data is then encrypted while travelling through Sunbird's infrastructure and remains encrypted on the user's device using AES-256. Sunbird also says its connections use certificate pinning.
The company says it does not retain copies of users' conversations on its own servers. Instead, message history remains on the sender's and recipient's devices.
Sunbird says messages passing through its infrastructure are released after delivery. It also says photos and videos sent through the service are automatically deleted from its systems, normally within 48 hours and no later than 72 hours.
The handling of Apple ID credentials has also been changed.
Users still need an Apple ID to connect Sunbird to iMessage. However, Sunbird says the Apple ID password is used only once to establish the session and is then destroyed. The company says it does not retain the password or an authentication token that could later be used to sign into the account.
Sunbird also says each user's iMessage connection operates inside its own private environment. According to the company, that environment is destroyed when the user disconnects or deletes their account.
For messages travelling to an iPhone, Sunbird says Apple's existing iMessage end-to-end encryption protects the final part of the communication. The company says it does not modify or weaken Apple's encryption.
These changes address several of the areas that created problems in the previous version. However, they remain claims made by the company and need to be considered separately from what independent researchers have been able to verify.
Company says independent testing found no critical vulnerabilities
Sunbird CEO Danny Mizrahi has said that an independent security firm tested the rebuilt application and found no critical vulnerabilities. The company is using this assessment as part of its security case for the relaunched service.
The distinction between an independent assessment being conducted and its findings being publicly available is important here.
A publicly available audit would allow security researchers and other experts to examine what was tested, which parts of the application were included, what methodology was used and what limitations applied to the assessment.
For now, Sunbird's public security information provides details about the architecture and the company's data-handling practices, but users should still distinguish between those statements and independent verification of the complete system.
That is particularly relevant because Sunbird's previous service also made strong security claims before researchers found problems with the implementation.
The current application may have been rebuilt to address those problems, but continued independent testing would provide a stronger way to determine whether the new security controls work as intended.
Sunbird adds an AI assistant
Security is not the only area Sunbird is changing with the relaunch.
The company is preparing an AI assistant called Sunbird Intelligence, which is expected to arrive later in 2026. Sunbird says the AI will run directly on the user's phone rather than sending conversations to a remote service for processing.
One planned feature, called "Catch Me Up," is designed to summarise conversations that users have missed. The company also plans features that can draft replies and suggest actions based on conversations.
Sunbird says its AI system will eventually be able to perform tasks such as moving conversations between inbox categories, archiving chats and drafting or sending replies.
The planned AI features introduce another privacy consideration because the assistant would need to process the content of users' conversations to provide summaries and generate replies.
Sunbird's decision to run the AI on the device is therefore relevant to its privacy claims. However, the actual privacy protections will depend on how the system is implemented, what information it can access and whether any conversation data leaves the device when the feature is used.
RCS has also changed the reason for using Sunbird
The messaging market has changed since Sunbird's first attempt to bring iMessage to Android.
Apple introduced support for RCS with iOS 18, giving Android-to-iPhone conversations access to features such as higher-quality media, read receipts and typing indicators when RCS is supported.
This reduces some of the practical differences that previously existed between Android and iPhone messaging.
Sunbird is therefore returning to a market where Android users already have a better cross-platform messaging experience than they did in 2023. The main distinction Sunbird offers is continued access to Apple's iMessage system and the blue-bubble experience.
There are also technical differences. Sunbird's iMessage service does not register a user's Android phone number with iMessage. According to MacRumors, users appear to iPhone contacts through their email address when using Sunbird.
This means the company's proposition has changed from simply providing Android users with features that were missing from SMS-based conversations. It is now combining iMessage access with a broader messaging application that brings several services together.
Sunbird now has to prove its security claims
Sunbird's new application contains several changes compared with the service that was paused in 2023.
The company says messages are encrypted on the device and during transmission, Apple ID passwords are used once and destroyed, media is automatically deleted from its infrastructure, and conversations are not permanently stored on its servers.
These changes address some of the security problems researchers identified in the previous implementation.
However, the history of the service makes independent verification particularly important. In 2023, researchers were able to demonstrate that sensitive information could be accessed through Sunbird's infrastructure despite the company's previous claims about encryption.
Sunbird now has another opportunity to establish whether its redesigned architecture can provide the privacy and security protections it promises.
More than 181,000 people signed up during the early-access period, showing that there is still interest in using iMessage from Android. But with RCS now supported on both major mobile platforms and with the security problems of the previous Sunbird implementation still part of the company's history, the new application's long-term success will depend heavily on whether its security controls withstand continued independent testing.
For Sunbird, bringing back the blue bubble is only one part of the challenge. The larger test is whether users can trust the infrastructure carrying their messages this time.
Unlike automated privacy tools, these high-end services combine data removal with continuous monitoring and manual audits designed to reduce both online exposure and physical security threats.
Consumer-focused services such as DeleteMe, Incogni and Google’s free PII removal tool can help limit exposure, but their reach remains restricted. Data brokers often use measures to prevent automated deletion requests. “insert something like a captcha to ensure that a bot can’t come in and wipe out their database,” Tom Aldrich, chief operating officer of digital exposure reduction firm 360 Privacy, told Observer.
Aldrich said his company, which works with 32 Fortune 100 companies, recently took on a wealthy client who had previously used an automated service. The firm discovered 62 profiles belonging to the individual across hundreds of data aggregation platforms. “We found 62 different profiles on them across hundreds of data aggregator sources,” said Aldrich, who added that 93 percent of those profiles included non-public information and could be removed.
Security experts increasingly warn that information available online can create risks in the physical world. Threats against senior executives have risen steadily over the past two decades, with attacks in 2025 more than doubling compared with the previous year.
“Physical and digital can no longer be separate,” Brian Hill, field chief information security officer at personal cybersecurity firm BlackCloak, which serves corporate executives and high-net-worth individuals, told Observer.
The connection became particularly evident in the case of Vance Boelter, the Minnesota gunman sentenced in July to two consecutive life sentences plus 40 years for killing Democratic lawmakers in 2025. Boelter reportedly used data aggregator websites to identify his victims.
Growing concerns around executive safety have also pushed security spending higher. The median security expenditure for executives at S&P 500 companies increased 37.8 percent between 2024 and 2025. During the same period, S&P 500 CEOs earned an average annual compensation of $18.9 million.
Meta was among the biggest spenders, allocating more than $25 million toward physical and digital security for CEO Mark Zuckerberg.
For family offices, celebrities and high-net-worth clients, BlackCloak's services can cost between $10,000 and roughly $200,000 annually. Enterprise contracts covering executives, board members and founders can reach as much as $600,000 per year.
The expanding digital footprint of consumers has created an entire economy around personal-data protection. Data brokers collect and sell personal information to third parties, contributing to a North American data-broker market estimated at $40 billion.
Removing such information is often difficult and labor-intensive, increasing demand for specialized providers that can continuously identify and eliminate exposed data.
Only California, Oregon, Texas and Vermont currently require data brokers to identify themselves through state registries. More than 4,000 data brokers are estimated to operate across the U.S., with many outside the reach of comprehensive regulation. California alone has 545 registered data brokers.
Premium privacy firms typically remove information from publicly accessible websites while also monitoring the dark web and strengthening security across users' accounts and devices. Connected household technology, including security cameras, may also be included in these security assessments.
Still, complete digital anonymity is difficult to achieve. “Reducing your digital footprint to zero is virtually impossible,” said Hill. “Our goal is anywhere from 70–90 percent removal of data.”
Certain public records, including newspaper archives and campaign donation records, can also remain difficult or impossible to erase.
While high-end privacy protection is increasingly being adopted by wealthy individuals and corporations, more affordable services can still help ordinary consumers reduce their exposure.
Aura, for example, offers automated data removal alongside other digital safety services for families at $32 per month. “As data breaches continue, data brokers expand, and A.I. makes it easier to exploit personal information, more people are looking for ways to reduce their digital footprint and regain control of their privacy,” Tom Clayton, president and chief operating officer of Aura, told Observer.
Despite the growing number of services available, adoption remains relatively low. Only 6 percent of American adults use data-removal services, while more than half do not know such services exist.
Smaller businesses are increasingly vulnerable as well. “The attackers are…going after the small companies, the local family businesses. They’re now becoming the targets because they’re the easy ones,” Hill said.
Executives and their families continue to face particular risks. According to a 2025 report from BlackCloak and the Ponemon Institute, 51 percent of security leaders said cyberattacks had targeted the personal accounts of executives or their family members.
As personal and professional digital lives become increasingly intertwined, conventional corporate security teams may not fully protect executives' personal information. That gap is helping drive demand for specialized privacy and cybersecurity providers.
Artificial intelligence and emerging technologies could make the problem even more challenging. “With a lot of this technology,” said Hill about A.I. and quantum computing, “you’re going to see a lot more data collection, and it’s going to be easier to go after the people that don’t set up an LLC or trust because they just don’t think they need to.”
For commuters, a journey on public transport can now come with an unexpected soundtrack: someone else's smartphone.
A passenger watching videos without headphones, streaming music through a phone speaker or taking a call on loudspeaker turns what should be a private activity into something everyone nearby can hear. The habit has acquired names including “loudcasting” and “sodcasting”, and growing public frustration is prompting transport authorities, politicians and businesses to reconsider how phone use should fit into shared spaces.
Ofcom's 2022 research found that 46% of people had watched videos without headphones in public, while 45% had made video calls and 36% had listened to music without them. The behaviour was particularly common among teenagers. Among 13-to-17-year-olds, 83% considered watching videos without headphones acceptable, compared with 21% of people aged 55 and above. At the same time, eight in 10 people said loudcasting annoyed them.
Newer polling suggests the irritation has persisted. A 2025 YouGov survey found that 79% of Britons were bothered by people playing music or videos through phone speakers, including 41% who said they were bothered "a great deal".
The divide is therefore not simply about whether people use their phones loudly. It is also about what different generations consider acceptable behaviour in public.
Why do people loudcast?
Researchers studying technology and behaviour argue that loudcasting can serve purposes beyond simple disregard for others.
For younger people, smartphones are often social devices. Friends travelling together may watch content, listen to music or make video calls collectively. Playing something aloud can also become a form of self-expression, allowing users to display their musical or entertainment preferences to people around them.
This helps explain why the behaviour can appear perfectly ordinary to one passenger and deeply irritating to another.
The phenomenon itself is not entirely new. Previous technologies, from portable radios to boomboxes, generated similar arguments about noise in shared environments. Even early mobile-phone users could attract disapproving looks for speaking on their devices in public.
What has changed is the scale of what a smartphone can deliver. A single device can now stream video, music, social-media content and live conversations almost anywhere.
Faster mobile networks and increasingly accessible data have made consuming that content while travelling easier, reducing the practical barriers that once encouraged people to wait until they reached a private space.
Why does phone audio feel so intrusive?
The irritation may also have less to do with volume than with context.
Researchers who study soundscapes distinguish between noises people expect to hear in particular environments and sounds that appear out of place. Passengers generally expect the noise of engines, brakes and railway tracks on public transport, allowing them to become accustomed to those sounds.
A stranger's conversation or video is different. It contains information that the brain may automatically try to process, while unpredictable changes between speech, music and video clips repeatedly attract attention.
The result is that a relatively quiet smartphone can sometimes feel more disruptive than a louder but predictable background noise.
The Covid-19 lockdowns may have complicated those social expectations further. People spent prolonged periods consuming media and communicating from home, where they did not have to negotiate the same public-space etiquette. Some researchers argue that certain habits may have followed people back into shared environments.
Should loudcasting be punished?
The debate has increasingly moved from social etiquette into policy.
Transport for London has repeatedly encouraged passengers to use headphones, while its earlier research found loud mobile conversations and audible headphone music were already among the most commonly witnessed forms of inconsiderate behaviour.
The Liberal Democrats have called for tougher penalties, including fines of up to £1,000, while a 2025 YouGov poll found that 62% of Britons supported fines for playing music or videos aloud on public transport.
However, Britain already has legal mechanisms for dealing with disruptive noise. Railway byelaws prohibit behaviour that interferes with other passengers' comfort or convenience and restrict sound-producing equipment when it causes annoyance. Updated railway byelaws came into force in 2025.
The Bus Services Act 2025 has also expanded the powers available to local transport authorities to create and enforce passenger-behaviour byelaws.
Businesses are beginning to establish their own rules as well. In August 2026, Wetherspoons introduced a policy across its 792 UK pubs prohibiting customers from playing music or taking calls through phone loudspeakers, following complaints about disruptive noise.
A global problem with different social rules
The dispute is not uniquely British.
Countries differ considerably in how strongly public spaces are governed by expectations of quiet. Japan, for example, has strict social norms around phone use on public transport, while other more individualistic societies may tolerate louder personal behaviour.
Ofcom's research also found differences in loudcasting behaviour between ethnic groups, but negative reactions remained high across all groups, suggesting that the behaviour cannot be explained simply through ethnicity. Age, social context, cultural expectations and individual technology habits are likely to intersect.
The central question is therefore not whether smartphones will continue producing sound in public. They almost certainly will.
The question is whether society will continue treating that sound as a breach of etiquette, introduce stronger rules to control it, or gradually become so accustomed to it that another person's phone becomes just another part of the public soundscape.
OpenAI published the research on August 1, using the name Astra for its next major model family. The work spans several areas of advanced mathematics, including group theory, high-dimensional geometry, coding theory, quantum complexity, lattice cryptography and extremal combinatorics.
The research was released as a 249-page collection of manuscripts, accompanied by machine-checkable certificates for each of the 10 results. The problems were not routine mathematical exercises: several had remained open for decades and were regarded as significant questions within their respective fields.
Among the reported breakthroughs are a construction demonstrating the existence of non-sofic groups, a disproof of Connes's rigidity conjecture in the theory of von Neumann algebras, and an improved general upper bound for sphere-packing density in high dimensions. The latter improves upon a bound that had remained in place since 1978.
Three of the problems also came from the extensive collection of unsolved questions associated with mathematician Paul Erdős.
The announcement builds on a result reported in May, when the same model family was said to have disproved the Erdős unit distance conjecture, an 80-year-old problem in discrete geometry that had resisted sustained efforts since 1946. Fields Medalist Tim Gowers said he would have recommended the proof for publication in a leading mathematics journal without hesitation. A group of nine mathematicians, including Gowers and Noga Alon, subsequently published a companion paper presenting the proof in a more accessible form for human mathematicians.
Thomas Bloom, who maintains the ErdÅ‘s problem catalogue, described the August results as “big news” and said they were even more significant than the earlier unit distance result. OpenAI researcher Noam Brown offered a more cautious assessment: “Sadly, no Millennium Prize Problems (yet).”
AI research announcements have frequently faced questions over whether reported achievements can be independently evaluated. Benchmarks can be influenced by training data, demonstrations can be selectively presented, and external researchers may have limited ways to reproduce proprietary results.
Astra's mathematical work takes a different approach because the reported proofs were formalized using Lean, a proof assistant designed to verify mathematical arguments step by step. OpenAI also released the certificate files on GitHub under an open license, allowing researchers to download them and run the verification process themselves.
If an individual step does not logically follow from what came before it, the checker rejects the proof. The process therefore does not depend on trusting the organization that produced the result or on subjective interpretation of the argument.
Traditionally, a major mathematical proof goes through peer review, with human experts potentially spending months examining its reasoning before the wider community accepts the result. Machine verification can dramatically shorten the technical verification stage, allowing the validity of a formalized argument to be checked almost immediately.
That distinction makes the Astra announcement different from a conventional AI benchmark. A machine-verified proof can be independently checked even when the underlying model itself is not publicly available.
There are, however, important limitations to the claims.
The selection of the 10 problems was controlled by OpenAI, meaning the published results may not represent the full range of problems the model attempted. The reported $2,000 figure also relates to the successful results rather than the total cost of all experimentation, making it more accurately a measure of the cost of producing the published results than the complete cost of mathematical discovery.
OpenAI researchers also participated in preparing the papers and formalizing the arguments, while the company maintains that Astra generated the mathematical content. Because Astra itself is not available to external researchers, independent reproduction of the model's discovery process is not currently possible.
AI critic Gary Marcus described the release as impressive but substantially oversold. Some mathematicians have also suggested that further scrutiny could reveal that only a portion of the 10 problems represent genuinely unexpected breakthroughs, while others may prove to have been problems that were technically approachable but had not yet received the necessary attention.
Even with those qualifications, one feature remains significant: the results can be mechanically verified. Whether or not the problem selection was optimized for success, a result accompanied by a formal certificate is fundamentally different from an AI-generated claim that cannot be independently checked.
The larger implication may extend well beyond mathematical research.
AI systems can generate large quantities of content and technical output, but organizations often struggle to validate that output at the same scale. Human review may work for a handful of documents or analyses, but it becomes increasingly impractical as AI-generated output grows.
Some industries have already addressed this challenge by building automated verification into their workflows.
Chip design is a prominent example. Formal verification systems can mathematically establish whether a circuit meets its specifications, providing an automated layer of assurance that existed well before generative AI became widely used.
At Computex in May, Cadence said it had expanded its design agent toward full autonomy. The system reportedly runs hundreds of simulations through the company's Jasper formal verification engine, reducing a validation cycle that previously took around five weeks to less than a day. Synopsys offers a similar category of technology through VC Formal, which uses static analysis to verify designs rather than relying solely on individual test cases.
The economics are straightforward: when a machine-generated answer can be checked automatically and inexpensively, mistakes become far easier to detect and correct.
The same principle applies to areas such as cryptography, safety-critical software and hardware verification, where formal proof or automated checking is already part of the development process.
As AI systems become capable of generating increasingly sophisticated output, the ability to verify that output may become more important than the ability to generate it.
The central shift is therefore not simply that AI can produce difficult answers more cheaply. It is that the bottleneck is moving from generating an answer to proving that the answer is correct.
Phishing is no longer limited to technically skilled criminals building fraudulent campaigns from scratch. Through phishing-as-a-service (PhaaS), attackers can rent ready-made infrastructure and tools that allow them to impersonate trusted organisations, harvest credentials and target victims at scale.
Phishing attacks use social engineering to persuade victims to surrender sensitive information. The lure can arrive through an email, text message, phone call, QR code, fake website or malicious application, often impersonating a bank, employer, delivery company or another trusted entity. Stolen passwords, financial details and authentication information can then be used for account takeovers, fraud, identity theft or further attacks.
The emergence of PhaaS has made this process considerably easier.
PhaaS lowers the barrier for cybercriminals
Instead of developing an operation independently, criminals can purchase packages containing fake login pages, legitimate-looking email templates, phishing-site hosting, target lists and setup instructions. Some providers also offer technical assistance and campaign-management capabilities.
The model mirrors legitimate software-as-a-service businesses, except the product is designed to facilitate cybercrime. Microsoft describes the wider cybercrime-as-a-service economy as increasingly commercialised, with specialised services allowing criminals to outsource different parts of an attack.
This creates a multiplier effect. Criminals with limited technical expertise can deploy infrastructure developed by more experienced operators, allowing phishing campaigns to reach far more people than a small group of skilled attackers could target independently.
The threat is therefore not simply that individual phishing messages are becoming more convincing. It is that the number of people capable of launching campaigns is increasing.
PhaaS is evolving beyond password theft
Modern phishing services can also target authentication sessions rather than simply collecting usernames and passwords.
Adversary-in-the-middle attacks, for example, place attacker-controlled infrastructure between a victim and the legitimate authentication service. The victim may still complete the expected login and MFA process, while the attacker attempts to capture authentication information or session tokens that can later be used to access the account.
Microsoft has documented phishing campaigns in which attackers captured tokens generated during legitimate authentication, demonstrating why stolen credentials are not the only concern.
The scale of these operations was illustrated in March 2026 when authorities disrupted Tycoon 2FA, a PhaaS platform that facilitated phishing attacks against nearly 100,000 organisations. Europol said the service generated tens of millions of phishing emails each month and, by mid-2025, accounted for roughly 62% of phishing attempts blocked by Microsoft.
AI is making familiar warning signs less reliable
Artificial intelligence is adding another advantage for attackers by making social-engineering content faster and easier to produce.
Poor grammar and spelling mistakes were once common indicators of phishing. Generative AI can now produce polished messages in seconds, allowing criminals to create more convincing communications and adapt them to different targets. Microsoft has reported that cybercriminals are using AI to automate phishing and generate synthetic content.
Users therefore need to focus less on whether a message is grammatically correct and more on what it is asking them to do.
Unexpected requests for passwords, payment information, verification codes or urgent account actions should be independently verified. Links should be inspected before opening, while sensitive websites are safer to access directly rather than through unsolicited messages. Unexpected attachments should also be treated cautiously.
Defence must account for stolen credentials
Basic security practices remain important, but organisations should also assume that phishing attempts will occasionally succeed.
Unique passwords stored in a password manager can limit the damage caused by credential reuse, while multifactor authentication adds another layer of protection. However, phishing-resistant authentication such as passkeys and FIDO-based methods provides stronger protection against attacks designed to capture authentication information.
Microsoft says phishing-resistant MFA can stop more than 99% of attacks of this type even when attackers possess the password.
Organisations should also monitor unusual account activity, remove unnecessary accounts and minimise user privileges so that compromised credentials do not automatically provide extensive access.
PhaaS has therefore changed more than the technical mechanics of phishing. It has changed who can conduct these attacks and how easily they can be scaled. As criminal infrastructure becomes increasingly commercialised and AI reduces the effort required to produce convincing lures, defending against phishing can no longer depend solely on recognising suspicious messages.
The stronger strategy is to combine user awareness with authentication and access controls designed to limit what happens when a phishing attempt succeeds.
Starting a consulting business can look deceptively simple. You have expertise, you know there are businesses that need it, and unlike a product company, you do not need a warehouse full of inventory before you can start selling.
But turning expertise into a functioning consulting business is another matter.
There is a point when consulting stops being an idea and becomes a business.
It is usually somewhere between sending the first proposal and realizing that knowing how to solve a client's problem is only one part of the job. The founder now has to find the right customers, decide what the work is worth, manage contracts and finances, build a reputation and keep the pipeline moving, often while delivering the work alone.
That makes the first 90 days particularly crucial.
For a new consulting firm, those months are not simply about landing the first client. They are a testing period for the entire business model. Who actually needs the service? What are they willing to pay? Which prospects are worth pursuing? How should projects be priced? And can the founder deliver the work efficiently without creating an operation that collapses as soon as demand increases?
Market research is one of the earliest safeguards. The U.S. Small Business Administration recommends examining demand, market size, competition, economic conditions and the prices customers already pay before committing to a business idea. Competitive analysis can then help a company identify where it can establish an advantage.
For consultants, that process starts with getting specific.
Know exactly what you are selling
"Consulting" is not a niche.
A prospective client needs to understand what expertise is being offered, what problem it addresses and why this particular consultant is equipped to solve it.
That is why specialization can matter so much during the early stages. A consultant who focuses on regulatory compliance for fintech companies, for example, enters the market with a much clearer proposition than one advertising a general ability to "help businesses grow."
A narrow focus also makes research easier. The founder can identify competitors, understand the language customers use to describe their problems and determine whether there is enough demand to support the business.
The goal is not to permanently lock the consultancy into one category. It is to give the market a clear reason to remember it.
The same attention should go to the business name before significant money is spent on branding. Founders should check whether the name is already being used, whether an appropriate domain is available and whether matching social-media accounts can be secured. Legal and trademark availability should also be checked in the relevant jurisdiction.
A polished identity built around a name that cannot be used is an expensive problem to discover after launch.
Your first clients may already know you
A new consultant's first sales pipeline may be much closer than expected.
Former colleagues, previous clients, mentors and professional contacts can become referral sources, particularly when they understand exactly what the new business does.
Consulting Success has reported that 60% of consultants get their first client through referrals from their existing network.
That figure should not be treated as a promise that networking will automatically produce business. It does, however, point to an important reality for new consultants: relationships can be an early commercial asset.
The first 90 days should therefore include deliberate outreach. Reconnect with former colleagues. Tell people what service you are offering. Attend relevant industry events. Join professional or business-owner groups. Speak to people who understand the market you are trying to enter.
The objective is not to turn every conversation into a sales pitch.
It is to make sure that when someone in your network encounters the problem you solve, they know who to call.
Keeping track of these relationships can help, too. A basic customer relationship management system or even a structured contact database can record conversations, potential opportunities and follow-up dates. Networking becomes considerably more useful when it is treated as an ongoing business process rather than a collection of business cards.
Pricing your expertise is harder than selling it
The first proposal can create an uncomfortable question for almost every new consultant: What should this actually cost?
There is no single answer.
Some consultants charge by the hour. Others set a fixed fee for a defined project. Retainers can provide recurring revenue for continuing advisory work, while value-based pricing attempts to connect the fee to the business outcome being created rather than the number of hours spent producing it.
Each approach carries a different risk.
Hourly pricing is relatively straightforward, particularly when the scope of a project is uncertain. Fixed-fee work gives clients greater predictability, but the consultant can lose money if the project expands beyond the assumptions used to calculate the fee. Retainers can create more predictable revenue but require a clear understanding of what ongoing access or services the client is actually receiving.
Value-based pricing can potentially capture more of the economic value created for a client, but it is harder to establish when a new consultancy has limited evidence of its results.
The important thing is not to choose a pricing model simply because another consulting firm uses it.
New founders should track how much time projects actually consume, including meetings, revisions, administration and unpaid communication. They should also account for software, professional services, taxes and other operating expenses.
The SBA recommends calculating startup costs and using break-even analysis to understand how pricing, costs and sales volume interact.
That turns pricing from a guess into a business calculation.
And the model does not have to remain fixed. As a consultancy gains experience, it can adjust its pricing based on the type of work clients value most and the economics of delivering it.
Not every potential client is a real prospect
A large prospect list can look impressive while contributing very little to revenue.
Consultants need to distinguish between companies that could theoretically benefit from their expertise and companies that are actually positioned to buy it.
That means asking whether the organization has the problem, whether the problem is urgent, whether it has a budget, who makes the purchasing decision and whether the consultant has a credible route into the organization.
Financial and business research can make that process more informed.
For U.S. public companies, the SEC's EDGAR system provides access to company filings that can reveal information about financial performance, operations, risks and other corporate developments.
Private companies require different sources of information, including company websites, industry publications, professional networks and available business databases.
The objective is not to conduct an exhaustive investigation of every lead. It is to avoid spending valuable time chasing prospects that are unlikely to become paying clients.
For a solo consultant, that distinction can directly affect revenue. Time spent pursuing an unsuitable prospect is time that cannot be spent delivering client work, improving an offer or finding a better-qualified lead.
The tools behind the expertise matter too
Consulting is often presented as a knowledge business, but much of the actual work happens inside ordinary productivity software.
Spreadsheets, presentations, project-management platforms, customer relationship systems and document-management tools can become part of a consultant's daily workflow.
Management Consulted COO Namaan Mian has said consultants can spend around 80% of their day working in Excel and PowerPoint.
The exact proportion will vary considerably between consulting disciplines, but the underlying lesson is useful. A consultant who is excellent at strategy but inefficient at turning analysis into a financial model, presentation or client deliverable can lose considerable time.
Technology also introduces a responsibility that is easy for new consultants to overlook.
Clients may hand an independent consultant confidential business strategies, financial records, employee information, intellectual property or customer data. Secure authentication, controlled access, encrypted storage where appropriate, reliable backups and careful file-sharing practices therefore belong in the business plan from the beginning.
For a technology or cybersecurity consultant, that expectation is even higher. The consultant's own security practices become part of their credibility.
Do not try to be the lawyer and accountant too
Running a consultancy independently does not mean every business function needs to stay with the founder.
Legal and accounting professionals can help establish the structures that allow the consultant to concentrate on client work.
The right business structure can affect taxation, paperwork and personal liability, while contracts can determine how payment, confidentiality, intellectual property and responsibilities are handled between the consultant and client. The SBA recommends considering these structural questions when setting up a business and notes that professional advisers can help with the process.
An accountant can also help establish bookkeeping practices and make sure income and expenses are being tracked properly.
These advisers do not necessarily need to be permanent employees. For a small consultancy, external professionals can often provide support when specific legal or financial questions arise.
What matters is establishing those relationships before a problem forces the issue.
Build accountability into the business
There is one final problem unique to many solo consultants: nobody else is waiting for the work to get done.
The founder may have promised to follow up with prospects, update the website, send invoices, improve a presentation, review finances and develop a new service. Then a client deadline arrives and everything else moves down the list.
An accountability partner can provide a simple counterweight.
That person could be a former colleague, mentor, fellow entrepreneur or another professional encountered through an industry association or business group. A short weekly conversation can be enough to review what was completed, what was missed and what needs to happen next.
The point is not necessarily to find another person who has all the answers.
It is to create a system in which the founder has to answer to someone besides themselves.
The first 90 days are where the business gets tested
A new consultancy does not become sustainable simply because its founder is good at what they do.
Expertise gets the business into the room. Everything else determines whether it can stay there.
The first three months should therefore be used to test the market, sharpen the niche, build relationships, qualify prospects, experiment with pricing and establish the systems needed to deliver work consistently.
That includes the less glamorous work: checking the business name, setting up financial records, understanding legal obligations, learning the software that will be used every day and protecting client information.
The U.S. Small Business Administration describes a business plan as a roadmap for structuring, operating and growing a company, while its startup-cost guidance encourages founders to understand expenses and break-even points before making financial decisions.
For a consultant, the first 90 days can serve the same purpose in practice.
By the end of them, the founder should have more than a website and a client list. They should have evidence about which customers are worth pursuing, which services generate demand, what those services cost to deliver and what the business needs to operate without constantly running on improvisation.
That is the real moment when a consultant gets skin in the game.
The expertise may have been there for years.
Now there is a business behind it.