AzureIncident Teardowns
Zerologon (Aug–Sept 2020): Taking Over a Domain Controller in Seconds
In August 2020, Microsoft patched CVE-2020-1472, a critical flaw in the Netlogon Remote Protocol used by Windows domain controllers. In September,...
Insights
Cloud & AI security insights
News, breach teardowns, how-to guides, detections and CIO briefings for Microsoft 365, Entra ID, Azure, AWS and AI agents.
AzureHow-To & Hardening
How to Patch and Monitor Domain Controllers in Hybrid Azure Environments
Domain controllers hold the keys to your on-premises identity — and, in hybrid environments, a path to the cloud. Here is how to patch and monitor them...
AzureDetection & Response
Detecting Netlogon Exploitation: Defender for Cloud and Sentinel KQL
Attacks on Active Directory — including Zerologon exploitation, DCSync and Kerberos abuse — leave specific traces. Microsoft Defender for Identity and...
AzureCIO Briefings
CIO Brief: Hybrid Identity Means On-Prem Flaws Become Cloud Flaws
The short version: In 2020, a flaw called Zerologon let attackers take over a company's core identity system — Active Directory — in seconds, without a...
Microsoft 365Platform Changes
Microsoft Ignite 2020: The Defender Rebrand and Unified XDR Strategy
At Microsoft Ignite in September 2020, Microsoft reorganized its security products under a single brand: Microsoft Defender. The change reflected its...
Microsoft 365How-To & Hardening
How to Map the Microsoft Defender Product Family to Your Environment
Microsoft's security product names have changed many times. Here is a practical map of the Microsoft Defender family — what each product does and how to...
Microsoft 365How-To & Hardening
Microsoft Defender XDR Onboarding Checklist
Owning Microsoft Defender licenses isn't the same as being protected. Use this checklist to onboard the Defender XDR products properly.
Microsoft 365CIO Briefings
CIO Brief: Consolidating Security Tools Around Microsoft Defender
The short version: Many companies pay for Microsoft 365 E5 or similar licenses that include a full suite of security tools — and use only part of it....
Entra ID & IdentityIncident Teardowns
The Twitter Hack (July 2020): Phone Spear-Phishing Against Internal Admin Tools
On July 15, 2020, the Twitter accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Apple and others posted a cryptocurrency scam. Attackers had taken...
Entra ID & IdentityHow-To & Hardening
How to Protect Internal Admin Tools With Privileged Identity Management
Microsoft Entra Privileged Identity Management (PIM) makes administrative access temporary, approved and audited. Here is how to use it to protect admin...
Entra ID & IdentityDetection & Response
Detecting Admin Tool Social Engineering: Entra Sign-In Logs and Sentinel KQL
Attackers who social-engineer employees often go straight for administrative tools. Detecting unusual admin access helps you catch them before they act.
Entra ID & IdentityCIO Briefings
CIO Brief: Social Engineering Your Employees Beats Hacking Your Systems
The short version: In 2020, attackers took over the Twitter accounts of world leaders and celebrities — not by hacking Twitter's systems directly, but by...
Microsoft 365Incident Teardowns
Illicit Consent Grant Phishing (July 2020): Attackers Stop Stealing Passwords
In July 2020, Microsoft warned about a rise in consent phishing (also called illicit consent grant) campaigns, many using COVID-19 themes. Instead of...
Microsoft 365How-To & Hardening
How to Detect and Remove Malicious OAuth Apps in Microsoft 365
Malicious OAuth apps can read mail and files without a password. Here is how to find and remove them in Microsoft 365.
Microsoft 365Detection & Response
Detecting Illicit Consent Grant: Defender XDR and Sentinel Hunting Queries
Illicit consent grants give attackers persistent access to Microsoft 365 data. Detecting them quickly is essential because password resets don't remove them.
Microsoft 365CIO Briefings
CIO Brief: The Phishing Attack MFA Can't Stop
The short version: In 2020, attackers began tricking employees into clicking "Accept" on a Microsoft permission screen for a fake app. The employee signs in...
Multi-CloudIncident Teardowns
Blackbaud Ransomware (July 2020): When Your SaaS Provider Pays the Ransom
In July 2020, Blackbaud — a cloud software provider widely used by nonprofits, universities and healthcare organizations for fundraising and donor...
Multi-CloudHow-To & Hardening
How to Assess SaaS Vendors' Security Before You Sign
SaaS vendors hold your data, and their security directly affects yours. Here is a practical approach to assessing SaaS vendors before you sign —...
Multi-CloudDetection & Response
Monitoring Third-Party SaaS Risk Signals and Breach Notifications
You can't monitor a SaaS vendor's internal systems, but you can monitor signals that indicate rising risk — and your own exposure if something goes wrong.
Multi-CloudCIO Briefings
CIO Brief: Third-Party Ransomware and Your Disclosure Obligations
The short version: In 2020, Blackbaud — software used by thousands of charities and schools — was hit by ransomware and paid the attackers. Its customers...
Microsoft 365Incident Teardowns
Zoom-Bombing (Apr 2020): What It Taught Us About Teams Meeting Security
In early 2020, as remote work exploded, "Zoom-bombing" entered the vocabulary: uninvited people joined online meetings and classrooms to disrupt them with...
Microsoft 365How-To & Hardening
How to Lock Down Microsoft Teams Meeting Policies and Lobby Settings
Microsoft Teams meeting policies decide who can join, present and record. Here is how to tighten them without making meetings painful.
Microsoft 365Detection & Response
Detecting Meeting Hijacking: Defender XDR and Sentinel Hunting Queries
Meeting disruption and eavesdropping are rare, but when they happen in sensitive meetings the impact is high. These detections help you spot unusual meeting...
Microsoft 365CIO Briefings
CIO Brief: Collaboration Tools Are Now Critical Infrastructure
The short version: In 2020, uninvited strangers began crashing online meetings — "Zoom-bombing." It was a wake-up call: video meetings had become as...