Recently, I spent an hour testing something.

I copied data from a PDF into Excel. You might already know what happens when you do that manually: everything from the row jams into one cell. Complete mess.

So I opened Copilot in Excel and asked it to split the data for me.

It immediately went to formulas. Simple ones first, then increasingly complex combinations. I tested each one.

None of them split the values correctly.

Here's what I should have done: skipped the manual copy entirely and used Power Query from the start. Connect directly to the PDF. Five minutes max, done.

But Copilot never suggested that. It just answered the question I asked. I thought I wanted formulas. They felt like the repeatable solution. Copilot gave me exactly what I asked for. It just happened to be the wrong approach.

I talk about this "gap" and a lot more in my interview with an Australian journal for public accountants. You can read it here.

Make your year-end reports truly meaningful Every performance review starts with one question: why did results change? Understanding variances and commenting on them is essential. Without that context, numbers alone don’t explain performance. As year-end approaches, learn how to make variance analysis simple, consistent, and decision-ready in Power BI. See how modern FP&A teams use Zebra BI visuals to: automate variance calculations highlight key insights add commentary deliver reports that tell the full story instantly 🎁 Exclusive for the XelPlus community: ​Watch the tutorial and download free Power BI templates to apply the same approach in your reports. Thanks to Zebra BI for sponsoring this newsletter.

🤓 Geeky News

Security's having a moment this week. Some good news, some not so good. Here's what you need to know.

🔐 Microsoft Edge now saves and syncs passkeys

Passkeys let you sign in without typing passwords. Instead, you use your fingerprint, face, or PIN.

More secure than passwords (can't be guessed or phished). Faster too.

​Edge can now store passkeys in Microsoft Password Manager and sync them across your Windows devices.

When you create a passkey for a site, it gets saved to your Microsoft account and protected by a PIN you set up.

When you sign in on a new device, you'll need that PIN to unlock your passkeys.

Currently Windows only (version 10+, Edge 142+). Mobile and work accounts coming later.

The Windows plugin will let you use these passkeys in other browsers and apps soon.

🦊 Firefox cuts browser fingerprinting in half

Browser fingerprinting is how websites track you even when you block cookies or use private browsing. They collect details like your time zone, fonts, and graphics card specs to create a unique "fingerprint" that follows you across the web.

​Firefox 145 now blocks these tracking techniques in Private Browsing and Strict mode. The new protections target things like hardware details (processor cores, touchscreen capabilities) and how your graphics card renders images.

It aims to offer strong privacy without breaking legitimate site features. Calendar tools still get your real time zone. Games can still optimize for your hardware.

It's live now if you use Private Browsing or enable Strict tracking protection in settings.

⚠️ 2 billion emails exposed in massive password dump

​A huge collection of breached credentials just hit Have I Been Pwned. Almost 2 billion email addresses and 1.3 billion unique passwords from multiple sources.

Here's the scary part: People are still using these exposed passwords on active accounts right now.

This isn't one breach. It's a compilation of stealer logs and breaches going back to the 1990s. Attackers use these dumps for "credential stuffing" – trying your leaked password on banking sites, email, shopping accounts until something works.

What to do: Check Have I Been Pwned immediately. Change any compromised passwords. And if you're still reusing passwords across sites, stop.

Get a password manager. It's not optional anymore.

🤖 AI browsers want your passwords. Should you trust them?

New AI browsers like ChatGPT Atlas and Perplexity Comet promise to browse the web and complete tasks for you. Book meetings. Fill out forms. Handle your email.

The catch? They need access to everything. Your email. Calendar. Contacts. Logins.

The risk is something called "prompt injection attacks." Bad actors hide malicious instructions on web pages. When the AI reads that page, it can be tricked into exposing your data or taking actions you didn't approve.

Think unintended purchases, leaked emails, posts you never wrote.

Both OpenAI and Perplexity acknowledge this is an "unsolved security problem." They've added safeguards, but experts say there's no bulletproof solution yet.

What you can do now: Use unique passwords and multi-factor authentication for these AI browser accounts. Limit what they can access. Keep them away from banking, health records, and sensitive accounts.

These tools will get better. But right now, that convenience comes with real risk.

🙌 A tool that supports business decisions

Yes. Excel can help you with that. But so does Power BI. Congrats to Rozhin on completing Fast Track to Power BI.

Excel is powerful. Power BI is too. And when you know both, you've got options. You can tackle more problems. Show data in different ways. That's what makes you the go-to person.

See you next week,

Leila

Want more?

▶️ Subscribe on YouTube​

🖇️ Follow us on LinkedIn​

🥇 Join 400,000+ students in our courses​

📣 Want to sponsor Between the Sheets? Get in touch here.

📨 If you were forwarded this message, you can get the free weekly email here.

This newsletter contains affiliate links, which give us a small commission on any purchase made at no cost to you. This helps us run Between the Sheets and bring you updates like this. Thank you for your support!