Microsoft’s security tools are supposed to protect small businesses, but recent vulnerabilities have turned that premise on its head. GreatXML exploits weaknesses in BitLocker and the Windows Recovery Environment, allowing attackers with physical access to bypass disk encryption protections. RoguePlanet, meanwhile, leverages a race condition in Microsoft Defender’s malware protection engine to escalate privileges to SYSTEM level. Both issues highlight an uncomfortable reality: the integrated security stack that SMBs have been told to trust can itself become part of the threat model. This episode examines what went wrong, where responsibility lies, and why small businesses must stop treating vendor tooling as articles of faith. BitLocker and Defender remain valuable components of enterprise defence, but they require proper configuration, monitoring, and a realistic understanding of their limitations. Physical access attacks matter when laptops travel with staff. Local privilege escalation matters when attackers already have a foothold. And vendor responses matter when defenders are left scrambling to assess risk while corporate statements remain vague. The episode dissects both vulnerabilities, critiques Microsoft’s handling of the disclosure process, questions the researcher’s approach to public release, and ultimately argues that SMBs must move from buying comfort to buying outcomes. Security tools reduce risk; they do not eliminate the need for judgement, hardening, or accountability.