PA Municipalies

Spotlight Program

The Spotlight Program provides funding for smaller creative arts organizations and community-based programs that offer services, activities, or experiences connected to one or more of Pennsylvania Creative Industries’ strategic priorities.

Eligible programs may include community arts initiatives such as summer concert series, arts-focused summer camps, workshops, performances, festivals, exhibitions, and other creative programs that provide opportunities for residents to participate in or experience the arts.

Beyond financial support, the Spotlight Program also helps grantees build connections with others in Pennsylvania’s creative community. Participants may have opportunities to exchange ideas, learn from peers, and take part in discipline-specific webinars and other collaborative programming.

Application Opens: Monday, August 3, 2026
Application Closes: Monday, September 14, 2026

Creative Communities Initiative

The Creative Communities Initiative (CCI) provides multi-year funding to community-driven, arts-based projects that serve as catalysts for social cohesion, livability, and community and economic development. 

Letter of Interest is no longer a requirement!

Application opens: September 1, 2026.
Submission deadline: November 13, 5 P.M.

PA Creative Businesses

Keystone Creatives 

Keystone Creatives is a statewide initiative focused on helping Pennsylvania’s creative entrepreneurs build stronger, more sustainable businesses. The program connects artists, makers, designers, performers, and other creative professionals with funding opportunities, business resources, training, and a network of fellow entrepreneurs.

Through Keystone Creatives, entrepreneurs will also be able to access the next phase of the Creative Entrepreneur Accelerator (CEA) program. Developed by Bridgeway Capital and Pennsylvania Creative Industries, powered by the Pennsylvania Council on the Arts, the expanded CEA program is expected to offer increased funding opportunities along with additional business development support.

The Creative Entrepreneur Accelerator program was originally launched by the Pennsylvania Council on the Arts in 2021 to provide financial assistance and business development resources to creative entrepreneurs throughout the Commonwealth. Since its creation, the program has supported more than 1,000 Pennsylvania entrepreneurs.

For more information on upcoming grants, sign up for their newsletter.

Looking for grant money? Most municipalities and businesses don’t realize just how important a roll their website plays in the grant application process. Find out if your website is grant ready.

Municipalities and businesses are often overwhelmed by the many choices available when it comes to creating email addresses for their organization. Sometimes it just feels easier to use a personal email address than to go through the hassle of finding a reputable IT partner to set up a new email address every time sometime new flow through the organization. Rules and regulations aside, setting up an email address that uses your domain name can be more secure and definitely looks more professional. Let’s take a look at each piece of the puzzle.

Creating Email Addresses

Use Your Domain (TLD) for Better Authority

Choosing an email address that uses your official domain (e.g., @boroughname.gov or @businessname.com) is your first line of defense in professional communication.

• Verification: Official domains (especially .gov for municipalities) act as a “digital seal,” showing residents, customers, and vendors that the sender is legitimate and not a phishing attempt.
• Security Control: Unlike free personal providers, owning your domain allows you to set up security protocols (like multifactor authentication (MFA) or encryption) and ensure that when an employee leaves, the data stays within your control.

Why You Must Stop Using Personal Email Addresses

It may feel easier to use a “quick” Gmail or Yahoo account, but doing so for official business creates a significant “blurring of the lines” that is difficult to untangle later.

• Ownership Issues: If an employee uses a personal email and then leaves the organization, you lose the entire history of their professional contacts and communications.
• Best Practice: Municipalities should ensure that department heads (Secretary, Police Chief, etc.) use borough-specific accounts without exception to maintain a reliable “paper trail” for the position.

The Pennsylvania Right-to-Know (RTK) Trap

In Pennsylvania, the legal definition of a “public record” depends on the content of the message, not the account or device used to send it.

• The Law applies to Personal Accounts: If you conduct official agency business on a personal email account, those emails are considered public records under the PA Right-to-Know Law.
• Loss of Privacy during Discovery: If a resident files an RTK request, you may be legally required to search your personal inbox and turn over any relevant emails. This can lead to a significant invasion of privacy, as your entire private account could potentially be subject to review by legal officers to find responsive records.
• Constructive Possession: PA courts have ruled that records stored on non-agency devices are still “constructively possessed” by the municipality and must be produced upon request.

⚠️ Pennsylvania Legal Note: According to the PA Office of Open Records, the RTKL does not distinguish between agency business done on official computers versus personal devices. Using a dedicated official email address is the only way to ensure your personal communications stay private and separate from public record requests.

Individual Email versus Department Specific

This is where companies and municipalities differ. While it may seem cut-and-dry for a business to have department specific emails (accounting, support, sales), municipalities struggle to find the balance between ease-of-use and high turnover.

The Balancing Act for Municipalities

• The Problem with High Turnover: In many boroughs, council seats and committee roles change frequently. If you use only individual names (e.g., jdoe@borough.com), important history can be lost every election cycle if not managed correctly.
• Role-Based Stability: For key functions like the Secretary, Tax Collector, or Zoning Officer, having a department-specific address (e.g., manager@borough.gov) ensures that residents always know where to send official correspondence, regardless of who currently holds the office. It’s easy for a skilled IT professional to set up a forward if a specific person is to handle these tasks for a period of time.
• Individual Accountability: Conversely, name-specific emails are vital for internal accountability and digital signatures. They provide a clear audit trail for who authorized a specific action or sent a specific directive.

Unlike domains, once the email address is removed, no one can fake sending from that address unless it’s from your own mail server.

Pro Tip: For both commercial and municipal clients, use Departmental addresses for your website’s contact page and public forms to ensure continuity. Use Individual addresses for day-to-day operations to maintain a clear legal record of who said what and when.

Don’t Let Go of Old Domain Names

For example, you change from myborough.com to myboro.com and drop myborough.com. Someone else can pick up myborough.com and start sending mail out as myborough.com and you would have no way to prevent them from doing that. This makes it easy to trick people into thinking these spoofed emails are coming from a legitimate source. Paying for both domains for the foreseeable future would prevent people from doing a plethora of bad things with a domain name you no longer need.

Archiving Old Email

Managing the Transition

When it comes time to handle staff transitions, it is best to work with your IT department. You may even want to involve your solicitor to ensure that archiving is handled in accordance with all applicable laws or your municipality’s or organization’s digital policies.

• Aliasing: You can set up “aliases” so that one person receives mail for both jsmith@borough.gov and secretary@borough.gov. This gives them an individual identity while maintaining the departmental “front door.”
• The 12-Month Handover: Keeping an old address active for about a year ensures that any lingering official business or subscriptions tied to that person are successfully migrated to the new official.
• Archiving vs. Deletion: You can likely take the email address out of rotation after the 12-month forward is over. In a municipal setting, an email account should never just be “deleted.” Because of RTKL requirements, the data must be archived (using tools like MailStore or Microsoft 365 archiving) to ensure records remain accessible for their legally mandated retention period. Again, check with your solicitor to ensure that all rules and regulations are met.

It is more professional and more secure to use email addresses that end with your TLD for work. Of course, like anything else, the challenges that come with setting up email addresses for an organization can feel confusing. If you don’t have IT help within your organization, it might be wise to seek a trusted IT partner who can help you secure the right domain, set up consistent email addresses, handle staff transitions when they occur, and ensure secure and long-lasting email archives.

AI Memory Poisoning: When AI Learns the Wrong Lessons

Artificial intelligence tools are becoming part of everyday work. Employees use them to draft emails, summarize documents, answer questions, and help make decisions. Many of these tools are designed to remember information over time so they can provide more personalized and useful responses. But what happens when the information being remembered is incorrect, misleading, or intentionally manipulated?

This growing concern is known as AI memory poisoning.

AI memory poisoning occurs when false, harmful, or misleading information is introduced into an AI system’s memory or knowledge base. Over time, the AI may begin relying on that information when generating responses, making recommendations, or assisting users. The result can be biased answers, inaccurate information, unsafe recommendations, or decisions based on faulty assumptions.

How AI Memory Poisoning Works

Many people think of AI as a tool that simply answers questions based on its original training. Increasingly, however, AI systems can retain information from previous conversations, learn from organizational documents, or reference data stored in connected systems.

If inaccurate information enters that memory, the AI may begin treating it as fact.

For example, imagine an employee uploads a document containing outdated procedures. Another employee later asks the AI how to handle a particular task. If the AI references the outdated document, it may provide incorrect guidance. The problem becomes even more serious if someone intentionally inserts false information designed to influence future responses.

Unlike traditional cyberattacks that focus on stealing data or disrupting systems, memory poisoning targets trust. The goal is often to influence what the AI believes and how it responds.

Why It Matters

AI systems are increasingly used to assist with decisions that affect real people. If the information an AI relies on has been poisoned, the consequences can range from inconvenient to severe.

Potential outcomes include:

• Biased recommendations that favor certain viewpoints or groups.
• Incorrect information presented as fact.
• Unsafe instructions or recommendations.
• Reduced confidence in AI-generated results.
• Poor business or operational decisions based on inaccurate outputs.

In government offices, schools, businesses, and nonprofit organizations, these risks can affect daily operations and public trust.

A Simple Example

Consider an AI assistant that helps employees answer questions about company policies.

If someone uploads a document stating that remote access is allowed without multi-factor authentication, even though the policy was changed years ago, the AI may begin repeating that information. Employees who trust the AI could unknowingly follow an insecure practice.

Now imagine the information was added intentionally by someone seeking to weaken security controls. The AI may continue spreading the incorrect guidance until the issue is discovered and corrected.

The AI itself is not acting maliciously. It is simply relying on information it believes to be accurate.

Can Public AI Tools Be Affected?

Large AI providers invest significant resources into protecting their systems, but no AI platform is completely immune to manipulation.

Researchers have demonstrated various ways attackers can influence AI behavior through poisoned data, prompt injection attacks, manipulated knowledge sources, and memory abuse techniques. As AI systems become more personalized and connected to organizational data, protecting those information sources becomes increasingly important.

The risk is often greater within an organization’s own AI environment, where internal documents, shared files, and user-generated content may be trusted automatically.

Reducing the Risk

Organizations can take practical steps to help prevent AI memory poisoning.

First, treat information provided to AI systems the same way you would treat information entered into any business-critical application. Verify sources and ensure documents are accurate before making them available to AI tools.

Second, establish clear policies regarding who can upload, modify, or manage information that AI systems may reference.

Third, encourage employees to verify important AI-generated information rather than accepting every response at face value. AI should support decision-making, not replace human judgment.

Regular reviews of knowledge bases, shared documents, and AI-connected data sources can also help identify outdated or suspicious information before it causes problems.

Trust, But Verify

AI can be an incredibly useful workplace tool, but its effectiveness depends on the quality of the information it receives. When inaccurate information enters an AI’s memory, the results can include bias, misinformation, and unsafe recommendations.

As organizations continue adopting AI technologies, cybersecurity awareness must expand beyond traditional threats. Protecting systems is important, but protecting the information those systems rely on is equally critical.

The next time an AI provides an answer, remember that intelligence is only as reliable as the information behind it. When AI learns the wrong lessons, everyone who depends on it may be affected.

CourseVector grants permission to use this artwork for any non-commercial purpose as long as the CourseVector contact information remains, as is, on any reproduction or use.

Everyone Thought It Was Covered

When a ransomware attack hits, the finger-pointing starts almost immediately.

The IT provider says the software vendor should have caught it. The software vendor says the organization didn’t follow best practices. The cyber insurance company asks whether required security controls were actually in place. Meanwhile, the organization is left dealing with downtime, recovery costs, public scrutiny, and the question nobody wants to answer:

“Who was responsible for this?”

The uncomfortable reality is that cybersecurity often lives in a gray area of shared responsibility. Businesses, municipalities, nonprofits, and public agencies rely on a mix of internal staff, managed service providers, software vendors, cloud platforms, and cyber insurance policies. Everyone plays a role in security, but many organizations never clearly define who owns what.

That becomes a problem when assumptions replace accountability.

In 2025, a cyber insurer filed a lawsuit against technology vendors hired by one of its policyholders after paying out a ransomware claim. The insurer alleged that the vendors failed to provide security measures and services they had contracted to deliver, contributing to the cyber incident. Rather than simply absorbing the loss, the insurer sought to recover its payout from the organizations responsible for providing cybersecurity services.

Cases like this highlight an important shift in cybersecurity. Cyber insurance is no longer viewed as a blank check that pays for every breach. Insurers are increasingly scrutinizing security controls, vendor relationships, and contractual obligations before and after incidents occur. Organizations are also facing greater pressure to demonstrate that appropriate safeguards were in place and that third-party vendors fulfilled their responsibilities.

The lesson is simple: don’t assume someone else is handling security.

Ask your IT provider what protections they are responsible for. Review vendor contracts to understand security obligations. Verify that critical controls such as multifactor authentication, backups, monitoring, and employee training are actually being performed. Confirm that your cyber insurance requirements align with your current environment.

Most importantly, document who owns each piece of your cybersecurity program.

Because after a breach, everyone has an explanation.

Before a breach, make sure someone has accountability.

Security works best when responsibilities are clear, expectations are documented, and assumptions are eliminated. The organizations that recover most effectively from cyber incidents are often not the ones with the largest budgets. They are the ones that know exactly who is responsible for protecting what.

CourseVector grants permission to use this artwork for any non-commercial purpose as long as the CourseVector contact information remains, as is, on any reproduction or use.

This isn’t another sit-and-listen conference or click-based networking event. It’s an opportunity to hear fresh perspectives, discover practical tools, exchange ideas with peers, and walk away with strategies you can put into action immediately.

Attendees will enjoy engaging presentations, professional development opportunities, networking with local leaders, and conversations that continue long after the event ends. Whether you’re looking to expand your professional network, sharpen your skills, or simply gain a new perspective, The Exchange offers something for everyone.

The best part? Every attendee brings something valuable to the table. The Exchange isn’t just about learning from speakers. It’s about learning from one another.

Join us for a day of ideas, inspiration, and connections.

Learn. Share. Connect.

We can’t wait to see you at The Exchange.

Register Now!

In the past few years, AI has exploded and completely changed our society. Many businesses have leaned into incorporating AI into their operations. Specifically, businesses have had to adapt to how AI changes search results.

SEO used to be based solely on search engines, what words they were reading, how they evaluated your site’s performance, etc. Recently Google and many other search engines have been shifting their algorithms towards AI search. Often when you Google something, the first result will be an AI overview. 

In this article, we’ll explore how AI changes search results and the practical steps organizations can take to adapt to it.

How Searching Has Evolved

To understand how AI changes search results, we need to understand what changed. SEO’s basis used to be in short keywords. For instance “SEO services near me” or “local website builder.” However, most users tend to search using complete phrases or questions like, “How to improve my website’s SEO?” AI favors this sort of search in its analysis. 

How does this impact your site? Content should be formatted to align with the keywords AI favors. Think of the AI overview that Google gives you. Start with a key question, and underneath delve into the specifics of an answer. 

Adapting Content Strategy for How AI Changes Search Results

Now that we know how AI changes search results, we can begin to develop a strategy to tackle it. As detailed above, AI likes when content is formatted in clear blocks for consumer questions. Here are some examples of content that are ripe for AI optimization:

• FAQs
• How-to guides
• Educational articles
• Industry explainers
• Step-by-step tutorials

The structure of your content serves as the AI’s doorway. In order to get your content out there, the AI must first be able to read it. This can be achieved through simple structural changes, like:

• Clear headings
• Short paragraphs
• Bullet points
• Direct answers

By implementing a smart content strategy that takes AI into account, one can quickly and easily increase the reach of their content. 

What Metrics Should Businesses Monitor?

As with regular SEO, it is always important to keep track of analytics to measure an organization’s success. When it comes to AI, these are the analytics you should be watching: 

• Organic traffic
• Click-through rates
• Conversion rates
• Engagement metrics
• Lead generation

By tracking and understanding your analytics, you will better be able to evaluate your AI strategy, as well as brainstorm content decisions for the future. 

Common Mistakes to Avoid

AI integration is new, and so, one should be careful with it. Some common pitfalls when optimizing SEO for AI include: 

• Chasing AI Content at Scale
  • Don’t copy and paste your from AI for all of your content. This can degrade your businesses’ image and trust. 
• Ignoring User Experience
  • Even though reaching the AI is important, reaching the user is always the top priority. Make sure your site still works well for them. 
• Focusing Only on Rankings
  • Rankings are important, but don’t let them be your only metric for success. Visibility, authority, and conversions should also be considered.  

Conclusion

How AI changes search results will affect future strategy, but the core goal remains the same: helping users find reliable answers.

Businesses that focus on creating valuable content, demonstrating expertise, maintaining technical SEO best practices, and building authority will continue to thrive in the evolving search landscape.

Want to make sure your website is prepared for the future of search? Contact CourseVector for an SEO and website performance audit to identify opportunities for growth in an AI-driven search environment.

Introduction

When you run a website, it is easy to get overwhelmed by the sheer amount of numbers that are sent your way. From page views to customer journeys to contact form submissions, it can be confusing to grasp what analytics actually matter.

Analytics are the key to your site’s success. They tell you the past, present, and future of your web presence. So it is important to discern which analytics to stress about, and which to set aside. 

In this article we will discuss what website analytics matter, which don’t, and what to do with your data.

The Wrong Metrics

To understand what website analytics matter, we need to understand which don’t. One pitfall that website owners often fall into is an obsession with vanity metrics. Examples of vanity metrics include:

• Total pageviews
• Social media likes
• Raw visitor counts without context

While these numbers may look impressive, they don’t necessarily indicate business success. For example, you may have a large amount of page views, but are those customers viewing multiple pages, and staying on your site? Are you creating conversions? These questions can be answered by higher level analysis. 

When evaluating what website analytics matter, take a second to think. It is important to remember that numbers do not tell the whole story. One must be careful and consider the context behind the shocking numbers that you might receive. 

What Website Analytics Matter

Metric #1: Conversions

Conversions are arguably the most important metric on your site. A conversion occurs when a visitor completes a desired action.

Examples include:

• Contact form submissions
• Phone calls
• Quote requests
• Newsletter signups
• Event registrations
• Online purchases

The reason conversions matter is that they directly connect your website with your organizational opportunities and goals. Here we can really see what the website is bringing to the table. If you wonder what website analytics matter, conversions are always a safe bet.

Metric #2: Traffic Sources

Traffic sources help us to understand where our users are coming from. Essentially, they are how users found the website. 

Common sources include:

• Organic Search (Visitors from search engines)
• Direct Traffic (Users who type your URL directly or use bookmarks)
• Referral Traffic (Visitors from links on other websites)
• Social Media
• Email Marketing

Knowing where your traffic is coming from is essential to evaluating your investments. For example, if you run an email marketing campaign, how do you determine if that campaign was worth it? One way is to track traffic, and see if that campaign is really bringing new users to your site. 

Metric #3: SEO Statistics

SEO is the lifeblood of your site. Simply putting a page up on the web is not enough to ensure users will visit. Careful consideration of SEO must be implemented to continuously draw new users in.  

If you’re investing in SEO, monitor metrics such as:

• Organic traffic growth
• Search impressions
• Click-through rate (CTR)
• Keyword rankings
• Top-performing search pages

When you invest in a website, you want to make sure it is seen. By keeping track of SEO metrics, you can continuously improve your website, and therefore its search performance. 

Creating an Analytics Dashboard

One way to improve upon your data management, and to sort through which data you need to focus on, is to create an analytics dashboard. For most organizations, a monthly dashboard should include:

• Total users
• Conversion rate
• Top traffic sources
• Top landing pages
• Organic search traffic
• Website speed metrics

When it comes to communicating data with upper level management, it can be difficult. A data dashboard helps you to organize your information in a way that makes the most important information stand out. 

Conclusion

Website analytics should be a help to you, not a hurt. By understanding what website analytics matter and which don’t, you can make the most out of your data. 

So, what website analytics matter? Conversions, traffic sources, and SEO statistics. Each of these can be put into a data dashboard to make your data shine.

Rather than chasing vanity metrics, focus on conversions, traffic, and SEO performance. By tracking the metrics that truly matter, you’ll gain actionable insights that can guide smarter marketing and website decisions.

Need help understanding your website’s performance, and what website analytics matter? A professional website audit can identify opportunities to improve traffic, user experience, accessibility, and conversions. Contact CourseVector today to learn more. 

Since the new ruling of the Department of Justice, the adoption of specific technical standards for making accessible the services, programs, and activities offered by State and local government entities to the public through the web and mobile applications (“apps”) has gone into effect.

For agencies with a population over 50,000, they have until April 26, 2027, to be compliant. For agencies with a population under 50,000, they have until April 26, 2028, to be compliant. You can read more about the specific policy here. Though these deadlines may seem a ways off, it is important to prepare now for the eventual necessity of an accessible site.

All website owners are keenly aware of how important it is to have a website that is accessible to people of all abilities. In addition to assessing and fixing blatantly inaccessible elements of your site, it is a good idea to create a website accessibility statement. It is important to let users know that you’re trying, that you care, and that you’re willing to fix mistakes that make it difficult for them to use your site.

Today, we explain how to create a website accessibility statement, and some tools and tips to aid you in the process.

Website Accessibility Components

There is now a firm outline of what an accessible website is. The Department adopted the internationally recognized accessibility standard for web access, the Web Content Accessibility Guidelines (“WCAG”) 2.2. As such, your accessibility statement should include the following:

1. A statement letting users know that you are constantly working to make the website more accessible.
2. A list of things you’re doing to make your site more compliant.
3. A statement letting users know that if they experience difficulty with your site that they can contact you.
4. Information on browser compatibility information if you’d like.

W3C, the main international standards organization for the World Wide Web, has developed an accessibility statement tool to help you create a statement for your website.

Sample Website Accessibility Statement

CourseVector takes website accessibility seriously. If you use assistive technology (such as a Braille reader, a screen reader, or TTY) and the format of any material on this website interferes with your ability to access information, please contact us. To help us address the problem quickly, please indicate the nature of your accessibility issue, the preferred format in which to receive the material, the URL of the requested material, and your contact information. Users who need accessibility assistance can also contact us by phone through the Federal Information Relay Service at 1-800-877-8339 for TTY/Voice communication.

Accessibility Design Guidelines

We strive to comply with website accessibility standards. If you have difficulty accessing the site or have any comments or feedback, please do not hesitate to contact us.

Browser Accessibility Information

Many popular browsers contain built-in accessibility tools.

Microsoft Edge Accessibility Information
Firefox Accessibility Information
Chrome Accessibility Information

Adobe Reader makes viewing and printing PDF documents that appear on this website easier. To download this program for free, visit the Adobe website. To read PDF documents with a screen reader, please visit the Adobe Reader Accessibility website which provides useful tools and resources.

Sample Accessibility Template

We also have a sample accessibility statement that you can use as a start to creating your own website accessibility statement.

W3G also has an example of a very minimal accessibility statement.

More Accessibility tools and tips

Alt Tags for Accessibility
Accessible Poetry Plugin Review
The National Center on Disability and Access to Education’s accessible content “Cheat sheets” — Accessible Web Content
Creating Accessible PDFs
Contrast Checker
Microsoft Accessibility Checker
W3.org’s List of Accessibility Tools

As always, if you’re unsure whether your website meets legal guidelines, you’ll need to consult a lawyer who specializes in website accessibility.

Ready to make your site more accessible? CourseVector has partnered with UserWay to offer a discount on their accessibility plugin. This coupled with our maintenance program helps to ensure that your users are getting the best, most accessible experience possible.

What Is a Pharming Attack? How Fake Websites Secretly Redirect Users

Most people know to avoid suspicious emails and strange links. But what if you visited a fake website without ever clicking anything suspicious at all?

That’s the danger behind a pharming attack.

Unlike phishing, which relies on tricking someone into clicking a malicious link, pharming silently redirects users to fraudulent websites even when they type the correct web address. The result can be stolen passwords, compromised financial accounts, and unauthorized access to sensitive systems.

For municipalities, small businesses, and organizations that rely on online portals and trusted websites, understanding pharming is becoming increasingly important.

What Is Pharming?

Pharming is a type of cyberattack that redirects internet users from legitimate websites to fake ones without their knowledge.

These fake sites are often designed to look nearly identical to the real website. Once users enter their login credentials or sensitive information, attackers can capture that data and use it for fraud, identity theft, or further attacks.

In simple terms:

• Phishing tricks you into clicking a bad link
• Pharming reroutes you behind the scenes

That’s what makes pharming especially dangerous. Users may believe they are taking all the right precautions while still being redirected to a malicious site.

Example of a Pharming Attack

Imagine an employee types:

www.city-portal.gov

Instead of reaching the real portal, the user is secretly redirected to:

www.city-portal-secure.gov.fake

Chances are criminals will go to the trouble of making their site look as real as possible. The fake site may:

• Use the same logo
• Match the colors and layout
• Copy the login page
• Display a padlock icon

To the average user, everything appears normal.

Once credentials are entered, attackers may gain access to:

• Email accounts
• Financial systems
• Resident portals
• Vendor accounts
• Internal government resources

Why Pharming Is So Effective

Pharming works because it attacks trust. People are taught to:

• Avoid suspicious links
• Check for spelling mistakes
• Look for HTTPS security

But pharming can bypass many of those habits because users may still type the correct address themselves, making the attack feel invisible.

Organizations that rely heavily on public trust, such as municipalities, utilities, schools, and small businesses, can become especially vulnerable because residents and customers are accustomed to using familiar online portals.

Common Signs of a Fake Website

While pharming sites can be convincing, there are often subtle warning signs.

Watch for:

• Slightly altered domain names
• Extra words in the URL
• Unusual redirects
• Login pages that suddenly look different
• Security certificate warnings
• Requests for unusual information

Examples:

• borough-services.gov
• borough-services-secure.com
• borough-services.gov.fake

At a glance, these may look legitimate.

How Businesses and Municipalities Can Reduce the Risk

Preventing pharming attacks requires both technical protections and employee awareness.

Secure Your DNS

DNS filtering and DNS security tools can help block malicious redirects before users reach fake websites. This is probably too complicated for the average person. Partnering with a tech expert you trust can help.

Keep Devices Updated

Outdated routers, computers, and network devices may contain vulnerabilities attackers can exploit. This, too, probably requires an IT professional.

Use Multi-Factor Authentication (MFA)

Even if credentials are stolen, MFA can help prevent unauthorized access.

Train Employees

Cybersecurity awareness training remains one of the most effective defenses. Staff should know how to recognize suspicious redirects, unexpected login prompts, and unusual website behavior.

Monitor Website Traffic

Organizations should regularly monitor their domains, SSL certificates, and traffic patterns for signs of spoofing or unauthorized changes.

Pharming vs. Phishing: What’s the Difference?

Even though giant “Hollywood-style” pharming attacks are less common than phishing, with organizations relying more on cloud portals, users trusting browser autofill, and people rarely inspecting URLs carefully anymore, redirect-based attacks are increasingly effective. Criminals may also combine pharming with other types of attacks, like:

• phishing
• fake MFA prompts
• credential harvesting
• AI-generated spoofed websites

So the concept is evolving rather than disappearing. Because education is a huge component to protection, here’s a quick review of the difference between phishing and pharming.

Both attacks aim to steal information, but pharming is often more difficult for everyday users to detect.

CourseVector grants permission to use this artwork for any non-commercial purpose as long as the CourseVector contact information remains, as is, on any reproduction or use.

You Changed Your Password. So You’re Safe… Right?

We’re all told to change our passwords! It certainly feels like the responsible thing to do. So, you update your password, reluctantly. Maybe you change the year. Swap a symbol. Add a number.

From:

• Summer2024!
  To:
• Summer2025!

Different password. Problem solved.

Not exactly.

Hackers Don’t Guess Passwords — They Predict Them

The idea that hackers sit there guessing random passwords is outdated. Modern attacks are built on patterns. This becomes a problem when one account is exposed in a data breach. Here’s why:

When a password from one account is exposed in a data breach, attackers don’t stop there. They use software to automatically test variations like:

• Summer2024!
• Summer2025!
• Summer2024!!
• Summer2024@

This isn’t guesswork. It’s prediction.

And it works because most people think the same way when creating “new” passwords.

The Problem: Password Reuse in Disguise

Most users know they shouldn’t reuse passwords across accounts. So instead, they do something that feels safe:

• Add a number
• Change the year
• Swap a symbol

But this creates what security experts call: Password reuse in disguise

It looks different to you. But to an attacker (or the AI trying to crack the code), it’s just the next logical step in a sequence.

Why This Works Against You

There are three reasons this habit is so dangerous:

1. It’s Predictable

Humans are creatures of habit. Attackers rely on that.

2. It Bypasses Policy

Many systems accept slightly modified passwords as “new,” even though they’re just variations.

3. It Creates a False Sense of Security

This is the biggest issue.

You believe you’ve taken action, but your risk hasn’t actually changed.

What a Real “New Password” Looks Like

A secure password isn’t a variation. It’s something entirely unrelated.

Instead of:

• Winter2025!

Think:

• GlassRiver!82Truck

Or better yet, let a password manager generate it for you.

The key is: No recognizable pattern. No connection to your old password.

How to Break the Pattern (Without Losing Your Mind)

You don’t need to memorize dozens of complex passwords. You just need the right system.

> Use a Password Manager

It creates and stores unique passwords for every account.

> Turn on Multi-Factor Authentication (MFA)

Even if a password is compromised, MFA adds a second layer of protection.

> Stop “Updating” Passwords, Replace Them

A real update means starting fresh, not tweaking what you already had.

The Bottom Line

If your password follows a pattern, it can be predicted.

And if it can be predicted… it’s not new.

CourseVector grants permission to use this artwork for any non-commercial purpose as long as the CourseVector contact information remains, as is, on any reproduction or use.

We had a fantastic time at the PSATS Conference this year, and if you were there, you already know: the conversations were real, the challenges were familiar, and the need for better digital tools in local government hasn’t gone away.

So we’re doing something about it for one lucky (or maybe overdue) township.

Here’s the deal: CourseVector is giving away a $700 credit for the cost of hosting alone. That’s $905 in value, available for just $205, about as close to free as it gets.

But here’s the catch: We’re looking for the townships that don’t have it all together and probably don’t realize how much they’re missing.

You know the ones. The township with the bulletin board outside the office that doubles as their “community outreach.” The one where the secretary has been meaning to look into a website for three years. The one where the official “website” is a Facebook page that hasn’t been updated since 2019.

Those are the townships we want to help.

If you work alongside one, live in one, or just know one that’s been dragging its feet on getting a real online presence, this is your chance to give them a nudge, and a website, they can’t ignore.

Why does it matter?

Residents deserve to find meeting minutes, contact information, and local updates without driving to a corkboard. A basic, well-maintained website isn’t a luxury for townships anymore; it’s a baseline expectation. And for the townships that haven’t gotten there yet, the problem usually isn’t money. It’s inertia.

Townships need a website to:

• Be an information hub for residents.
• Alleviate common questions to township staff.
• Make documents and forms easily accessible.
• Help you win grant funding for future projects and infrastructure improvements.
• Promote activities and community withing your township.

And this is just a basic website!

This giveaway is designed to break that inertia. One nomination. One winning township. One less community left behind.

How to nominate:

Fill out the short form below. Tell us which township you’re nominating, why they need this, and what’s been holding them back. We’ll review submissions and select the township where a new website would make the biggest difference.

I'd like to nominate … for a free website in 2026(Required)

Nominee's Email address(Required)

Why this person, business, organzation deserves a boost in 2026(Required)

Tell us about yourself

Name(Required)

First Last

Email(Required)

How do you know CourseVector?(Required)

Current client

Future client

Reseller

Newsletter subscriber

Word of Mouth

Friend or Neighbor

Other

Signature(Required)

I understand that CourseVector will choose a winner at random to be announced in a future newsletter. Winner will be notified via email as well.

Submit

Nominations are open to townships and municipalities represented at the 2025 PSATS Conference.

Let’s get them online.

What is TLS/SSL?

A secure and private connection to protect you and your customers.

Security certificates are small data files that digitally bind an encryption key to an organization’s details. When installed on a web server, a certificate creates a secure, encrypted tunnel between two points, whether that’s connections to databases, other services, or most commonly, a visitor’s web browser. A TSL/SSL security certificate used to activate the padlock icon and the HTTPS protocol, enabling secure connections from a web server to a browser. These days, many browsers only show an icon or warning if there is a problem. Several types of certificates are available, each offering different levels of validation and security.

More on the different types of security certificates

How a TSL/SSL security certificate protects your data

Data Encryption: Data is encrypted while in transit between your device and its destination. Because many computers may relay that data along the way, encryption ensures it cannot be intercepted or read during transfer no matter how many stops it makes.

Authentication: A certificate provides a level of authentication, confirming that your website is legitimate and not a malicious site attempting to collect information. While a TLS/SSL can confirm authentication, it does not prevent malicious activity. The user must still be vigilant, ensuring they’ve reached walmart.com rather than walmartz.com.

Trust: Browsers signal that a website has a valid certificate installed via the padlock icon next to the URL. Users have come to expect and rely on this indicator as a baseline sign of safety.

Compliance: TLS certificates are required for PCI DSS and HIPAA compliant websites and communications. If your site handles payments or personal health information, a certificate is not optional.

How to install a certificate on your website

Installation can often be done without a technician; a quick search will turn up many step-by-step guides depending on your server type and certificate. After installation, be sure to check every page of your site, including images and forms, to confirm all URLs are loading over HTTPS and that no mixed-content warnings are appearing for visitors.

If you’d like help installing a TSL/SSL security certificate on your website, one of CourseVector’s technicians is happy to assist. Contact us today to learn more.