If your small business relies on BitLocker as your primary data-at-rest protection — and you've never touched the default configuration — you need to read this before your next workday.
A zero-day exploit called YellowKey is making the rounds, and it does something that should alarm every IT admin managing endpoints for a 50-person shop: it bypasses BitLocker-protected drives using nothing more than a USB stick. No domain credentials. No admin access. Just physical access to a machine.
What YellowKey Actually Does
According to Bruce Schneier's analysis on Schneier on Security, YellowKey reliably bypasses default Windows 11 BitLocker deployments by exploiting the TPM key storage mechanism. That last part is critical — the default configuration. The one most small businesses are running right now without ever changing a setting.
Here's the problem with TPM-only BitLocker in plain English: when your laptop boots, the TPM chip automatically hands the decryption key to Windows with no additional authentication required. That's convenient. It's also exactly what YellowKey exploits. The attack intercepts the key handoff between the TPM and the OS during boot, giving an attacker full access to your encrypted drive without ever knowing your Windows password.
The Hacker News confirmed that YellowKey is now formally tracked as CVE-2026-45585 with a CVSS score of 6.8, and — this is the part that should concern you — Microsoft has issued a mitigation, not a patch. That distinction matters. A mitigation means the underlying vulnerability still exists; Microsoft has simply made it harder to exploit under certain conditions. Your default BitLocker setup is still at risk.
And this isn't happening in isolation. As Security News reported on May 19, 2026, YellowKey is part of a broader wave of Windows zero-days — alongside GreenPlasma and MiniPlasma — disclosed over the past six weeks. If you're running default Windows configurations across your fleet, you're not dealing with one unpatched gap. You're dealing with several. We've covered how this compounds risk in our post on zero-day exploits vs. unpatched vulnerabilities for small businesses.
The Three Realistic Options for a Small Business
Let's skip the enterprise playbook and talk about what actually makes sense for a shop without a dedicated security team.
Option 1: BitLocker with Pre-Boot Authentication (Fix What You Have)
BitLocker isn't broken — the default configuration is broken. If you enable pre-boot PIN or USB key authentication, you force the user to provide something beyond what the TPM alone can supply. The decryption key never gets handed off automatically, which closes the door YellowKey walks through.
What this costs: Zero dollars. It's already in Windows.
What this takes: Group Policy changes across your fleet, user training on PIN entry at boot, and a recovery key management process (store these in Azure AD or a password manager — not a sticky note).
The catch: Every user now has to enter a PIN at every boot. For a 50-person shop, that's a support burden. Laptops that restart overnight for updates will sit at a PIN prompt until someone physically touches them. Plan for that.
Option 2: VeraCrypt for Sensitive Containers
VeraCrypt is free, open-source, and well-audited. It's not a full-disk encryption replacement for your entire fleet, but it's an excellent option for protecting specific high-value data — financial records, HR files, client contracts — in encrypted containers that live on otherwise standard machines.
What this costs: Free. Open source.
What this takes: Some technical setup, user training on mounting/unmounting containers, and discipline around actually using it.
The catch: VeraCrypt doesn't integrate with Windows login. It's a separate workflow. Users will forget, skip it, or store the container password in a browser — which is why we'd recommend pairing it with a dedicated password manager rather than a browser-based one.
Option 3: Hardware-Enforced Encryption (OPAL/TCG Drives)
Self-encrypting drives (SEDs) that comply with the OPAL standard handle encryption at the hardware level, independent of the OS. Combined with a pre-boot authentication solution like Absolute or WinMagic, you get encryption that doesn't rely on the Windows TPM handoff at all — which means YellowKey has nothing to exploit.
What this costs: $150–$300 per drive for OPAL-compliant SSDs, plus licensing for management software.
What this takes: Hardware procurement, deployment planning, and ongoing key management.
The catch: This is the right long-term answer for regulated environments (especially if you're working toward CMMC Level 1 compliance), but it's a capital expense that requires a refresh cycle to implement across an existing fleet.
What You Should Do This Week
You don't need to overhaul everything immediately. Here's a prioritized, practical sequence:
- Audit your current BitLocker configuration. Open Group Policy or Intune and verify whether pre-boot authentication is enabled. If you're not sure, assume it isn't.
- Enable BitLocker PIN on all laptops first. Desktops in locked offices are lower risk. Laptops that travel — or that a terminated employee might still have — are your immediate exposure. Speaking of which, make sure you have a solid employee offboarding process that includes device recovery and access revocation.
- Establish a recovery key escrow process. Before you roll out PIN-based BitLocker, make sure you have every recovery key stored somewhere you can actually find it. Azure AD, Intune, or a documented IT vault — your call, but document it.
- Evaluate VeraCrypt for your highest-sensitivity data. Even if full-fleet hardware encryption isn't in the budget, protecting your most critical files in an encrypted container costs nothing.
- Apply Microsoft's mitigation guidance. It's not a fix, but it reduces your attack surface while a real patch is in development.
The Bottom Line
YellowKey is a wake-up call for every small business that enabled BitLocker years ago and never thought about it again. The encryption is real — but the default configuration hands attackers the key during boot. Fixing that is a configuration change, not a product purchase. Do it this week.
Take Action
Configuration hardening is step one. But knowing whether your endpoints, network, and systems have other unpatched gaps — before an attacker finds them — is step two.
Oscar Six Security's Radar is a $99 vulnerability scan built for small businesses and IT admins who need real answers without enterprise pricing. It won't tell you what you already know. It'll show you what you don't.
Focus Forward. We've Got Your Six.