Category: Blog

Microsoft has steadily tightened default security across Microsoft 365. New tenants now come with stronger protections out of the box than environments created a few years ago. The catch is that older configurations do not automatically update. When Microsoft changes a default, it applies only to new tenants. Existing settings, user consents, inbox rules, and sharing links all remain in place unless someone actively reviews and updates them.

Below are five areas worth reviewing, especially if your tenant is more than a couple of years old, was set up by a prior IT provider, or has not been audited recently.

Before getting into the list, keep a few things in mind. Some settings require Business Premium, E3, or E5 licensing, so if an option is unavailable, licensing is usually the reason. Also, a few changes will affect how your team works today and may generate support requests. There is no need to roll everything out at once.

---

1. Default sharing links in SharePoint and OneDrive

When users share files, the default link type determines who can access them. Older tenants often default to “Anyone with the link,” meaning the file can be opened by anyone who has the URL, without authentication or tracking.

Newer environments typically default to “Only people in your organization,” but older sites and tenant level settings may still allow open sharing. That creates risk. For example, a document shared months ago could still be accessible externally if the link was never revoked.

Review this setting in the SharePoint admin center under Policies > Sharing. Changing the default to “Specific people” ensures new links require authentication. You can also set expiration limits on any remaining open links.

---

2. External email forwarding

Microsoft now blocks automatic forwarding to external email addresses by default as part of its secure by default initiative. However, older rules or custom configurations may still allow it.

A user who created a forwarding rule years ago may still be sending copies of all email to a personal account.

Check the outbound spam policy in the Microsoft Defender portal under Email and Collaboration > Policies and Rules > Anti spam policies. Confirm that automatic forwarding is disabled or system controlled.

Then review existing inbox rules for users to identify any forwarding to external addresses. The Purview audit log can help track when those rules were created.

---

3. Historical third party app access

As of July 2025, Microsoft introduced stricter controls on user consent for third party applications. New requests now require admin approval.

The issue is older permissions. Applications granted access in the past still retain whatever permissions they were given. This can include access to mail, calendars, and files.

Review these in Entra ID under Enterprise Applications. Sort by user consent and look for anything that no longer serves a purpose. Unused or unknown apps should be removed.

---

4. Audit log retention

Audit log retention increased to 180 days in October 2023 for standard logging. With E5 or the Purview Audit add on, some workloads extend to one year.

For many organizations, especially in healthcare, legal, or financial services, these defaults may not meet compliance requirements. Retention expectations are often measured in years.

Audit retention policies are managed in the Purview compliance portal. If longer retention is required, licensing upgrades may be needed before making changes.

---

5. MFA enforcement and Security Defaults

Multi factor authentication is one of the most critical controls, and it is often inconsistent in older tenants.

New tenants typically have Security Defaults enabled, which enforces MFA automatically. Older tenants may not. There is also a common gap when Conditional Access policies are introduced. Enabling Conditional Access can disable Security Defaults, and if policies are not fully configured, some users may be left without MFA protection.

Review the following:

• Security Defaults status in Entra ID Properties
• Conditional Access policies to ensure MFA is enforced for all users
• Any admin or break glass accounts that may be excluded

This is the highest risk area, so changes should be planned and tested carefully.

---

Recommended rollout order

Some of these changes are invisible to users, while others will impact daily workflows.

Start with audit log retention and third party app review since they do not affect users directly.
Next, verify external forwarding settings.
Then address sharing defaults, making sure to communicate changes in advance.
Finally, review MFA and Conditional Access, as this requires the most care and planning.

---

FAQs

Are newer Microsoft 365 tenants fully secure by default?
They are more secure than older setups, but still require review. Items like user permissions, sharing behavior, and legacy rules should always be checked.

Is “Anyone with the link” still allowed?
Some tenants still allow it. Newer environments typically restrict this, but both tenant and site level settings should be reviewed.

Is external forwarding disabled by default?
Yes, at the tenant level. Older rules may still exist and should be audited.

How long are audit logs retained?
Standard retention is 180 days. With the right licensing, some data can extend to one year.

Does Security Defaults cover everyone?
In new tenants, yes. In older environments using Conditional Access, coverage depends entirely on how policies are configured.

Small businesses are actually the most common ransomware targets by volume, even though many owners assume attackers go after large enterprises. In reality, a 20 to 30 person company hits the ideal balance for an attacker. There is enough revenue to justify the effort, no dedicated security team in place, and plenty of public information available to research in under an hour.

What follows is a step by step walkthrough of how a small business gets compromised, written from the attacker’s perspective. The company described is fictional, but the methods are consistent with current threat intelligence. After the walkthrough, you will see five clear points where this attack could have been stopped using controls that most small businesses already have.

---

Monday: how I picked you

I run a structured operation with a manageable workload. I track about 40 potential targets per month and focus on companies with 10 to 50 employees. That range offers the best return. Larger companies have security teams and legal support that complicate recovery. Smaller businesses often are not worth the effort. A 22 person company has the right mix of revenue, internal data, and urgency to recover operations quickly.

I did not discover you through a breach. I found you through public records. Business registries, government contracts, and licensing databases provide enough information to identify your company, estimate your size, and determine who inside your organization is most valuable to target.

Nothing going wrong at your company is actually a signal. It suggests credentials are still valid, staff is not on high alert, and no one has recently been forced to change passwords.

---

Tuesday: mapping your organization

Within about 40 minutes, I can build a basic org chart using only public sources.

LinkedIn shows current employees and job roles. Your office manager has been handling accounts payable, payroll, and invoicing for years. You list yourself as the owner, with a limited presence, which makes you less likely to notice unusual activity around your account.

Other public posts and listings fill in the gaps. I now know who handles money, what systems you likely use, and who can approve payments.

That person becomes my target. They have access, authority, and enough daily workload that a single extra email is less likely to stand out.

---

Wednesday: buying your credentials

I search underground marketplaces for credential dumps tied to your email domain. These are collected by infostealer malware and sold cheaply.

Two matches come back. One includes your office manager’s work email and password. The other appears tied to a personal account connected to your household or business.

I pay $14.

The password is not unique. It appeared in a prior breach and was never changed. Variations of it work across multiple services, including your Microsoft 365 account. The only barrier left is MFA.

---

Thursday: getting around MFA

MFA works, but only when implemented correctly.

Push notifications alone are harder to exploit now because Microsoft added number matching, but attackers have adapted. I use an adversary in the middle phishing attack. The login page looks legitimate, but it sits behind a proxy I control.

When your office manager signs in and approves the prompt, I capture the session token. Microsoft sees a valid login. I end up with full access.

As a backup, I also tried a phone call earlier in the day posing as your IT provider using a name I found online. If needed, I could prompt approval that way.

By the end of the day, I am inside the account. I create an inbox rule to forward emails silently and begin monitoring.

---

Friday afternoon: why I waited

I do not act immediately. I spend about a day and a half reviewing emails to understand your financial position and urgency.

I find your insurance details, bank balances, customer data, and upcoming deadlines. This tells me exactly what you can afford and how quickly you need to recover.

I set the ransom accordingly. High enough to matter, low enough to get paid.

I deploy encryption late Friday afternoon. Key staff are unavailable, leadership is offsite, and response time is delayed. By the time anyone reacts, operations are down.

My total cost was $14 and several hours of effort.

---

Where this attack would have failed

This scenario worked because several basic controls were missing. None of them are expensive, and most are already included in tools many businesses use.

1. Password reuse
   Enforcing unique passwords and blocking known compromised ones would have made the stolen credentials useless. Tools like Entra password protection and password managers solve this.
2. Phishing resistant MFA
   Methods like FIDO2 keys, passkeys, or Windows Hello prevent session token theft. Conditional Access policies and Defender for Office 365 would also reduce the risk.
3. External email forwarding
   Blocking forwarding rules at the tenant level would have prevented ongoing access to email.
4. Alert monitoring
   Security tools already flag suspicious actions like new forwarding rules. Someone reviewing those alerts could have stopped the attack early.
5. Public exposure of roles
   Public data is unavoidable, but oversharing responsibilities makes targeting easier. Limiting detail in profiles can reduce risk.

---

Three questions to ask your IT provider

1. Are we using phishing resistant MFA for critical accounts
2. Is external email forwarding blocked at the tenant level
3. Are our security alerts monitored and reviewed

---

FAQs

Do attackers really target small businesses?
Yes. Small and mid sized companies are often preferred targets because they offer a strong return with fewer defenses.

What is an adversary in the middle attack?
It captures login sessions by placing a proxy between the user and the real service, allowing the attacker to hijack authenticated sessions.

What is a stealer log?
A package of credentials collected by malware and sold on underground markets, often for a very low cost.

How expensive is an attack like this?
In many cases, the upfront cost is minimal. The barrier to entry is very low.

Could this have been stopped with tools I already have?
In many cases, yes. Most of the controls described are already included in common Microsoft 365 licensing and simply require proper configuration and monitoring.

If you have a cyber insurance renewal coming up, you may have noticed the application is longer and far more detailed than it used to be. That is intentional. Each new question is tied to a control that failed in real claims during 2023 and 2024. Carriers adjusted their underwriting based on those losses, and how you answer the application now carries more weight than before.

This guide breaks down why applications have expanded, what the newer sections are really asking, how to answer accurately without overstating your environment, and what you should focus on fixing in the 30 days leading up to submission. The biggest risk to avoid is rescission, where a claim is denied because the controls you certified were not actually in place at the time of the incident.

---

Why the application got longer

Recent applications were shaped by a few high impact events.

The MOVEit breach exposed weaknesses in third party software risk. Thousands of organizations were affected when attackers exploited a vulnerability in a widely used file transfer platform. Carriers paid across a large number of claims and now ask more detailed questions about vendor risk.

The Change Healthcare ransomware incident highlighted how a single point of failure can disrupt an entire ecosystem. The lack of MFA on a key access point contributed to the breach, and the scale of disruption led to much tighter questions around MFA, backup integrity, and incident response.

The Arup wire fraud case showed how convincing social engineering has become, especially with AI generated voices and video. That incident drove new requirements around payment verification and employee training.

If your business handles client funds, protected data, or financial transactions, expect more scrutiny. Those are the loss categories that drove these changes.

---

Backup requirements have tightened

Backup questions are no longer simple yes or no answers. Insurers now want to know if backups are immutable or air gapped, whether they have been tested, and whether they can be accessed or deleted using administrative credentials.

A strong answer demonstrates:

• Backups that cannot be altered or deleted during a defined retention window
• Separate authentication from your production environment
• A recent successful restore test

Basic backups stored on the same network without testing are a weak position and often trigger follow up questions or pricing changes.

---

MFA is now examined in detail

MFA is no longer a checkbox. Applications now ask if it is enforced across:

• Email
• VPN
• Remote access tools
• Administrative accounts
• Service accounts

All five need to be covered for a clean answer.

SMS based MFA is considered weak and may result in follow up questions. Stronger methods include authenticator apps or hardware based authentication.

Privileged access management is another area that now shows up. Insurers want to know how administrative credentials are stored, rotated, and monitored. Shared admin passwords without logging are one of the biggest red flags.

---

Wire transfer controls are now required

Following recent fraud cases, insurers now expect formal verification procedures for financial transactions.

This typically includes:

• Verifying transfer requests using a known phone number, not information in the request itself
• Requiring dual approval for larger transactions
• Training staff on social engineering risks, including deepfake scenarios

Informal processes are no longer sufficient. A documented policy is expected.

---

Endpoint security expectations have increased

Traditional antivirus is no longer enough for underwriting purposes.

Applications now ask:

• Whether endpoint detection and response is deployed
• Whether all systems are covered, including servers
• Whether alerts are actively monitored

Having monitoring in place is a major factor. If you do not currently have it, being clear about your plan and timeline is better than leaving the answer vague.

---

Vendor risk is now part of the application

Insurers want to understand which vendors hold your sensitive data and whether those vendors have been vetted.

You may be asked to list key vendors and confirm whether they provide security attestations such as SOC reports.

You are not expected to audit every vendor, but you are expected to know who they are and have started the conversation.

---

The biggest risk: misrepresentation

The most expensive mistake on a cyber insurance application is overstating your controls.

If an investigation shows that your environment did not match what you declared, the carrier can void the policy entirely. That means no coverage for the claim and potential recovery of previous payouts.

The right approach is simple:

• Answer truthfully
• Disclose gaps
• Provide a plan with a clear timeline

A higher premium is predictable. Losing coverage entirely is not.

---

30 day preparation checklist

Use this as a practical approach leading into renewal.

Week 1
Confirm MFA is in place across all required areas and upgrade authentication methods for admin accounts.

Weeks 1 to 2
Validate backups. Confirm immutability or separation and perform a test restore.

Week 2
Document a wire transfer policy with verification requirements and approval steps.

Weeks 2 to 3
Ensure endpoint protection covers all systems and confirm monitoring is active.

Week 3
Identify key vendors and request their security documentation.

Weeks 3 to 4
Review and update your incident response plan, then run a basic tabletop exercise.

Week 4
Complete the application honestly and document any remaining gaps with remediation dates.

---

FAQs

What does rescission mean
It means the insurer voids the policy entirely due to inaccurate information on the application.

Will lack of MFA lead to denial
Not always, but it can increase cost or limit coverage significantly.

What is the difference between endpoint monitoring and traditional antivirus
Traditional tools detect known threats. Modern tools monitor behavior and alert on suspicious activity, often with active response.

Why are applications more detailed now
They reflect real losses carriers paid and are designed to prevent those same failures from happening again.

What is an immutable backup
A backup that cannot be changed or deleted for a set period, even if administrative credentials are compromised.

A secure Microsoft Copilot rollout starts with a permissions audit before you enable a single trial license. Copilot pulls from emails, files, chats, and other content based on each user’s existing Microsoft 365 access. In most environments, those permissions are broader than anyone expects. Access builds up over years of projects, quick sharing decisions, and staff turnover. Microsoft now recommends cleaning that up first: understand who has access, fix anything that drifted out of scope, and apply sensitivity labels to confidential data.

This guide walks through how Copilot uses permissions, where oversharing usually exists, what Copilot can surface when access is too broad, how to run the audit Microsoft recommends, and what to fix before rollout.

---

How Copilot accesses your data

Copilot runs on Microsoft Graph, which connects services like Exchange, SharePoint, OneDrive, and Teams. When a user asks a question, Copilot pulls from content they already have permission to access.

Microsoft’s guidance is clear: Copilot only works within a user’s existing access.

That is accurate, but it is also where the risk lives. If access is broader than it should be, Copilot will surface more than you expect.

---

Why permissions tend to grow over time

In most organizations, access expands gradually.

Someone is given access to a project folder. The project ends, but access is never removed. Another team shares a document for quick collaboration. A Teams channel grows during an active project and is never cleaned up.

Over time, these small decisions accumulate. The result is an access structure that no one has fully reviewed.

In professional services firms, the risk is higher because the files themselves are the business. Client data, financials, contracts, and internal records often sit in the same systems without clear boundaries.

If a user has access, Copilot can use it. It does not evaluate whether that access still makes sense.

---

What Copilot can surface when permissions are too broad

When permissions are not reviewed, Copilot can pull together information that was never meant to be easily discoverable.

For example:

• Asking about compensation could return an old salary spreadsheet that was shared for hiring and never restricted
• Requesting a case summary could pull documents from a project a user should no longer see
• Asking about active deals could combine data from multiple sources into one output
• Searching for a former employee could surface HR records and internal discussions
• Asking about pricing could expose internal financial models shared during a proposal

The issue is not the question itself. The issue is that the underlying access still exists.

---

Why pilots can introduce risk

A small pilot may feel like a safe way to test Copilot, but it often creates more exposure than expected.

Pilot users are usually senior employees. They tend to have the broadest access in the organization, which means Copilot can pull from the widest pool of data.

There is also a tendency for licenses to get reassigned casually. Over time, the original pilot scope can drift without anyone reassessing access.

Copilot activity can be reviewed after the fact, but once information is returned to a user, it cannot be taken back.

---

What to clean up before enabling Copilot

Before starting any trial, there are four areas to review.

SharePoint access review
Run a sharing audit to identify sites and libraries with overly broad access. Focus on files shared beyond the intended group.

OneDrive external sharing
Look for files that were shared externally and never revoked. These are common in client facing workflows.

Teams membership
Review team and channel membership to confirm it matches current responsibilities. Remove users who no longer need access.

Sensitivity labels
Apply labels to define what content is confidential. This allows you to control how files are accessed and can prevent Copilot from interacting with sensitive data when needed.

These steps typically take several weeks in an environment with accumulated history, but they are what determine whether Copilot adds value or creates risk.

---

The question to ask your IT provider

Before moving forward, ask for a simple report:

“Can you show a list of files accessible to large groups and identify which ones contain financial, employee, or client data?”

If they can provide a clear answer quickly, your environment has likely been maintained well. If not, that signals the permissions audit has not been done and should come first.

---

FAQs

Does Copilot access everything in Microsoft 365
No. It only accesses content the user already has permission to see.

Can sensitivity labels limit what Copilot can read
Yes. Labels with proper controls can restrict access and prevent certain content from being used.

Is a pilot still a good idea
It can be, but only if the users involved have appropriately scoped access.

How long does preparation take
Most environments need time to review sharing, clean up access, and apply labels before rollout.

What does Microsoft recommend
Microsoft emphasizes addressing oversharing first, then adding controls and governance before deploying Copilot at scale.

Cyber insurance applications now include a question that surprises many small business owners: “Do you maintain immutable, air gapped, or offline backups of your critical data?”

That question is there for a reason. Ransomware attackers have learned that the fastest way to force payment is to delete backups first, then encrypt everything else. Federal agencies and law enforcement have repeatedly documented this pattern. If your backups can be wiped using the same admin credentials an attacker just stole, you are left with no recovery option other than paying the ransom.

This guide explains what immutable backup actually means, which common setups do not qualify, what to ask your IT provider before signing the form, and how to proceed if your answer is no.

---

What immutable backup actually means

An immutable backup is one that cannot be changed or deleted for a defined period of time, no matter who tries.

That includes:

• You
• Your IT provider
• Anyone using stolen administrator credentials

This last point is what matters most to insurers. In a typical setup, an admin account can delete backups. Immutability removes that risk by enforcing protection at the storage level, where no user permission can override it during the retention window.

You may hear different terms depending on the platform, such as object lock or write once read many storage. The terminology varies, but the control is the same.

---

Three common setups that do not qualify

These scenarios come up often and are usually misunderstood.

A NAS or external drive in the office

Local storage devices are accessible from your network. If ransomware spreads, it can reach them. If an attacker gains admin access, those backups can be deleted.

They can still play a role in your strategy, but on their own they do not meet the requirement.

---

Treating Microsoft 365 retention as a backup

Microsoft 365 includes retention features, but they are not the same as a true backup.

A compromised global admin account can still delete data or remove retention protections. Microsoft’s shared responsibility model makes it clear that protecting your data is still your responsibility.

If this is your only layer of protection, the honest answer to the insurance question is no.

---

Cloud backups without immutability enabled

Many modern backup platforms support immutability, but the feature is not always turned on.

This is one of the most common gaps. A business may be paying for a solid backup solution, but the critical setting is disabled. You cannot assume it is configured correctly without verifying it.

---

Three questions to ask your IT provider

Before you check the box on your application, send these questions directly to whoever manages your backups.

1. Are our backups immutable, and how long is the retention window
Most insurers look for a minimum of 14 days, with 30 days becoming the new standard. This gives you recovery points from before an attacker entered your environment.

2. If our admin accounts were compromised, could they delete our backups
The correct answer should be no. If the answer is yes or unclear, your backups do not meet the requirement.

3. Can you provide proof that immutability is enabled
This could be a screenshot or vendor documentation tied to your environment. A provider who has configured this properly should be able to show it.

---

What a compliant setup looks like

For your answer to hold up, several elements need to be in place together.

• Immutability must be enabled, not just available
• Backup credentials must be separate from your primary admin accounts
• The retention window must be long enough to account for delayed attacks
• Restore testing must be completed and documented

Using a reputable vendor alone is not enough. The configuration and separation of access are what matter.

---

What to do if your answer is no

Answer the application honestly, then use the renewal as a trigger to fix the gap.

Start by asking if your current backup platform supports immutability. In many cases, it does and simply needs to be enabled.

If your provider cannot clearly answer the questions above, that is a signal this area has not been properly addressed and needs attention.

One thing to avoid is checking yes when the control is not in place. Cyber insurance applications function as warranty documents. If a claim occurs and your backups do not match what you declared, the insurer can void the policy entirely and deny coverage.

Answering no may increase your premium or limit coverage, but that cost is predictable. Misrepresentation creates a much larger risk.

---

FAQs

What does immutable backup mean in simple terms
It means nobody can delete or change the backup for a set period, even with admin access.

Is Microsoft 365 retention enough
No. It does not prevent a compromised admin from removing data.

How long should backups be protected
At least 14 days, with 30 days becoming more common as a baseline.

Can this be fixed without buying new tools
Often yes. Many platforms already support immutability and just need configuration changes.

What happens if I answer incorrectly
The insurer can void your policy after a claim, leaving you without coverage.

By the time an employee gives notice, whether their exit will be smooth or chaotic has already been decided. Those decisions happen during the first few weeks on the job, when no one is paying close attention. A shared login gets created. A quick SaaS signup happens. Someone uses a personal laptop until company hardware arrives. By month six, none of it feels like a decision anymore. It just feels like how things are done.

This post breaks down why offboarding drags on for weeks, the onboarding shortcuts that create that problem, how to clean things up for your existing team, and what your IT provider should be doing upfront but often is not.

---

What’s really happening when offboarding takes three weeks

A clean offboarding should take about 60 to 90 minutes on the IT side. Disable the user in your identity system and access drops across connected tools. Wipe or collect the device. Forward email or convert it to a shared mailbox. Reassign ownership in your CRM and project systems. Use a standard handoff document that was set up at onboarding.

When it becomes messy, it turns into a weeks long process. No one has a complete list of tools. You end up asking the employee to help reconstruct access. Along the way you uncover accounts in tools that were set up independently, each with credentials only they control. The laptop is at home and not a priority to return. A client mentions a strange message from a personal email. A month later you find a subscription still being billed.

The difference comes down to how things were set up on day one.

In identity terms, this is the joiner, mover, leaver lifecycle. If onboarding is rushed, all the cleanup gets pushed into offboarding.

---

Four onboarding shortcuts that cause problems later

Letting employees sign up for tools on their own

When someone creates an account on their own using their work email, that account becomes tied to them. You may not know it exists, and you cannot easily take control of it.

This is the root cause of missing logins during offboarding. Every tool should be provisioned through a central identity system so ownership stays with the business.

---

Allowing personal devices as a temporary solution

Temporary usually becomes permanent. The employee installs apps, stores files, and connects to company systems.

When they leave, you have no control over that device. You are relying on cooperation instead of having a technical control in place.

The fix is straightforward. Issue company devices from day one and enroll them in device management. If personal devices are allowed, require managed access for email and files.

---

Using shared logins to save money

Shared accounts create problems immediately at exit. You cannot remove one person without resetting access for everyone. Often, no one actually knows the password.

Paying per user solves this cleanly. Shared access usually costs more in time and risk later.

---

Keeping client relationships in personal inboxes

In many service businesses, client history lives in one person’s email. When that person leaves, context disappears.

From the client’s perspective, the business suddenly loses track of the relationship.

The fix is to centralize communication. Use a shared mailbox or CRM so conversations are stored in a place the business controls.

---

Cleaning this up with your current team

You cannot redo onboarding for your existing staff, but you can fix what is already in place.

SaaS audit

Review the last three months of business credit card statements. List every recurring subscription. Identify who set it up, who has access, and whether the business can take control if that person leaves.

You will find tools no one remembers, accounts tied to one individual, and licenses still active for former employees.

---

Build a device register

Create a simple list of who uses which device, whether it is managed, and what company data it can access.

Ask employees to confirm what they use, including personal devices. The goal is visibility. For personal devices, ensure company data is accessed through controlled methods that can be revoked.

---

Move client communication into shared systems

Shift important conversations out of personal inboxes. A shared mailbox with a simple expectation to copy in client communication can solve a large part of the problem. A CRM adds even more structure.

---

What your IT provider should be doing at onboarding

Many IT providers only get involved when someone leaves. They disable accounts, collect equipment, and work through whatever documentation exists.

That is the wrong point in the lifecycle.

A strong approach starts at onboarding. Your IT provider should:

• Create the user in your identity system
• Provision access through single sign on
• Set up and enroll devices in management
• Keep a record of what systems the user can access

They should also maintain a basic handoff document that tracks responsibilities, systems, and access tied to each employee.

When that work is done upfront, offboarding becomes a checklist instead of a scramble.

---

A simple plan to get ahead of this

You do not need to wait for someone to leave to start fixing this.

Weeks 1 to 2
Review SaaS subscriptions and identify single owner accounts.

Weeks 3 to 4
Document all devices and confirm how company data is accessed.

Weeks 5 to 6
Move key client communication into shared systems.

Weeks 7 to 8
Define a clean onboarding process and use it going forward.

Most of this is operational, not technical. A spreadsheet, a few conversations, and some focused time from your IT provider will handle the majority of it.

---

FAQs

How long should offboarding take
With proper setup, the IT portion can usually be completed in about an hour.

How do I find unknown tools my team is using
Start with credit card statements. Most subscriptions show up there.

Can I wipe a personal device after someone leaves
Only if that control was set up in advance through device management or managed app access.

Why does single sign on matter
It allows you to disable one account and remove access everywhere at once.

Should employees only use company devices
That is the safest approach. If personal devices are used, there should be controls in place to protect and remove company data.

Most cybersecurity incidents do not begin with sophisticated exploits or highly skilled adversaries. They start with everyday decisions made in the flow of work. Actions that feel harmless or even necessary in the moment can create entry points that attackers are specifically trained to exploit.

A reused password is one of the simplest examples. When an employee uses the same credentials across multiple systems, a breach in any one of those platforms can quickly cascade into broader access. Attackers rely on this behavior through credential stuffing techniques, where stolen usernames and passwords are tested across business systems at scale. What appears to be convenience at the user level becomes systemic risk at the organizational level.

Similarly, the use of personal email or cloud storage introduces gaps that traditional security tools often cannot see. Corporate security environments are typically designed to monitor and protect managed systems, approved applications, and known networks. When a user forwards a document to a personal inbox or uploads it to an unsanctioned file-sharing platform, that data effectively leaves the visibility of the organization’s security controls. This type of “shadow IT” is rarely malicious in intent. It is usually driven by speed, accessibility, or familiarity. Yet it creates blind spots where sensitive information can be exposed, lost, or retained outside of policy.

The modern workplace has only amplified this challenge. Remote work, mobile access, and bring-your-own-device policies have dissolved the traditional network perimeter. Employees now operate across home networks, personal devices, and third-party platforms, often switching contexts throughout the day. The line between personal and professional activity is no longer clearly defined, and security strategies built around rigid boundaries struggle to keep pace with this reality.

Because of this, effective cybersecurity cannot depend solely on preventing mistakes. Human behavior is inherently variable, especially in fast-paced business environments where efficiency and responsiveness are prioritized. Training and awareness are important, but they are not sufficient on their own. Even well-trained users will occasionally take shortcuts under pressure.

The more effective approach is to assume that these behaviors will happen and design systems that are resilient to them. This includes implementing safeguards such as multi-factor authentication, which reduces the impact of compromised credentials, and conditional access policies that evaluate the context of each login attempt. It also means deploying data loss prevention tools that can detect and restrict sensitive information from being shared outside approved channels, even when users attempt to do so.

Equally important is designing workflows that align with how people actually work. When secure options are overly complex or slow, users naturally seek alternatives. Security controls should be integrated in a way that minimizes friction. For example, providing secure, organization-approved file sharing solutions that are as easy to use as consumer platforms can significantly reduce the likelihood of data being moved outside sanctioned systems. Convenience, when aligned with security, becomes a powerful control in itself.

Visibility also plays a critical role. Organizations need insight into user activity across endpoints, cloud applications, and identities to detect anomalies early. Modern endpoint detection and response (EDR) and extended detection and response (XDR) platforms help bridge gaps by correlating behavior across multiple surfaces. Rather than focusing only on blocking threats, these systems enable rapid identification and containment when something does go wrong.

Ultimately, cybersecurity maturity is not measured by the absence of human error but by how well an organization contains and recovers from it. The goal is not perfection. It is resilience. By acknowledging that ordinary behavior will continue to intersect with sensitive systems, businesses can shift from reactive defense to proactive design.

In doing so, they create environments where employees can work efficiently while the underlying systems quietly absorb and mitigate risk. That balance between usability and protection is what defines effective cybersecurity in today’s interconnected world.

Business email compromise attacks are becoming more convincing, more targeted, and more expensive.

Artificial intelligence is helping attackers create fraudulent requests that look almost identical to legitimate business communications. For Accounts Payable teams processing invoices and payment requests every day, that creates serious operational risk.

Today’s fraudulent messages can mimic executive writing styles, reference real projects, and blend directly into normal workflow activity. Voice-cloning tools are even being used to simulate verbal approvals.

The organizations reducing fraud risk most effectively are not relying entirely on employees spotting suspicious behavior. They are building stronger operational controls around financial workflows and payment verification.