» Resources » Eye Security Blog »
If a threat actor logged into one of your employees’ Microsoft 365 accounts right now, how long would it take you to notice?
Microsoft 365 runs the modern business. Email, calendars, files, collaboration, identity: this is where work happens and where your most sensitive information lives. Microsoft pours billions into securing that infrastructure every year, and it shows: the platform is secure.
The biggest risks facing businesses today rarely come from a failure in Microsoft’s technology. They come from how identities are configured, protected, and monitored once they are inside your environment. And this is where you come in.
As the platform has become central to business operations, it has also become one of the most attractive targets for cybercriminals.
In the State of Business Email Compromise 2026 report published earlier this year, Eye Security identified that 99% + of BEC incidents occurred in Microsoft 365 environments.
This concentration highlights a wider industry shift. Threat actors are following identities. Where businesses store their most valuable information and conduct their daily operations is where criminals increasingly focus their efforts.
Modern attackers are no longer focused solely on exploiting software vulnerabilities. They steal credentials, compromise identities, and use legitimate accounts to move through businesses unnoticed.
Securing Microsoft 365, therefore, requires more than simply having the platform in place. You need the right security controls, ongoing monitoring, and the ability to respond quickly when suspicious activity occurs.
“Identity attacks thrive not on technical complexity but on credibility and timing. Eye Security’s data reinforces that defending against such incidents calls for email authentication controls, continuous user awareness, and vigilant financial process validation to counter manipulation at its human core.”
– Lodi Hensen, VP Security Alliances
Our research shows that business email compromise (BEC) has become one of the dominant threats affecting Microsoft 365 environments.
Instead of deploying malware, threat actors use compromised accounts to impersonate trusted individuals, manipulate conversations, and convince employees or suppliers to take fraudulent actions.
These actions take the form of activities such as requesting fake payments, changing supplier bank details, and accessing sensitive information. The communication often ‘originates’ from a genuine account, making these attacks extremely difficult to identify.
“Across dozens of investigations this year, we’ve seen that threat actors rarely succeed because environments lack tools; they succeed because organisations don’t truly operate from the assume-breach posture. In many cases, the breach was already well underway before anyone realised what was happening.”
– Lodi Hensen, VP Security Alliances
Read The State of Cyber Incidents 2026
For many, Microsoft 365 is where their most sensitive business information lives.
A single account provides access to:
Rather than launching a traditional attack against a company’s network, criminals now use stolen credentials to access a legitimate account and operate as a trusted employee.
The challenge is that Microsoft 365 sits at the centre of business trust. Employees use it every day to communicate, share documents, and approve decisions.
When an attacker gains access to a legitimate account, they inherit that trust.
Gaining access is only the beginning. Once a threat actor is inside a Microsoft 365 account, they do not need malware. They do not need to escalate through your network. And often, they do not need to move fast.
They read, they wait, and they use the trust that comes with a legitimate account. Real Eye Security investigations show how this plays out.
In one Eye Security incident response case, attackers compromised email communication between the finance controllers of an international headquarters and its national organisations. Payment requests, complete with real invoices, were followed up with emails carrying fraudulent bank account details. Money kept moving, just not to the intended recipients.
By the time the finance team retraced the payment trail, the fraud amounted to roughly a million in misdirected payments. And the cost did not stop there. Incident response, legal and cross-border compliance work, PR and reputational management, and internal IT overtime all followed.
This is the endgame of the same pattern: patient abuse of a trusted communication channel and a familiar business process, payment approval, until real money leaves the business.
In a second case, a single Microsoft 365 account was compromised twice in the same week by two unrelated threat actors, neither of whom appeared to be working with the other. They simply found and abused the same weak point.
What each of them did after logging in is the instructive part:
The takeaway: once identity is compromised, a single inbox can become a shared opportunity for multiple cybercriminals. The question then becomes: “How many times, by whom, and what did each of them do?”
While the platform provides powerful security capabilities, attackers continue to exploit the same weaknesses repeatedly: compromised identities, poor configuration, trusted communication channels, and a lack of visibility.
“Threat actors did not rely on novel exploits or advanced malware. They operated within trusted environments, using legitimate access, familiar workflows, and increasingly, AI-enhanced social engineering.”
Threat actors frequently use phishing emails, fake login pages, and malware to steal usernames, passwords, and authentication information, as explored in our recent article on identity attacks across Europe.
Once they gain access to a legitimate account, they can bypass many traditional security controls because their activity appears to come from a genuine user.
In Eye Security’s State of Business Email Compromise 2026, phishing via link was the single dominant entry vector, accounting for 63% of BEC incidents.
Technology has improved significantly, but attackers continue to rely on one of the oldest techniques in the book: convincing people to trust something they should not.
What has changed is not the tactic but its quality and speed, and that change is driven by AI.
Modern phishing attacks are convincing, using personal information, realistic branding, and AI-generated content to appear legitimate. The emails themselves are no longer the giveaway. Increasingly, it is what happens after a user clicks that determines whether an attack succeeds.
“The consequence for defenders is that the email itself is no longer the giveaway. The old advice, look for spelling mistakes, hover over the link, distrust anything generic, was built for an era of low-effort phishing that AI has effectively ended. Increasingly, it is not whether someone spots a suspicious email that decides the outcome.”
And what happens after the click is often invisible to the user.
Modern commercialised phishing kits do not just harvest a password. They proxy the real Microsoft 365 login, capture the authenticated session, and step straight past multi-factor authentication. The user completes a genuine login; the attacker walks in with them. This is why awareness training, though still valuable, cannot be the last line of defence.
When AI makes lures faster to write, easier to personalise and harder to recognise, and when a single click can hand over an authenticated session, teams need controls that assume some phishing will succeed. This means detection of unusual behaviour after sign-in, and the ability to contain, at AI speed, a compromised account before it causes damage.
Microsoft 365 includes a wide range of security features, but these tools are only effective when they are correctly configured and maintained.
The mistakes we see most often include
Below, we look at what this means for SMEs and our recommendations on tightening up your security features,
For many teams, the challenge is not a lack of available security technology, but ensuring those controls are correctly implemented.
Unlike traditional network attacks, configuration weaknesses can remain invisible for months. An organisation may have Microsoft 365 deployed correctly from a technical perspective, but still leave unnecessary access or permissions available to attackers.
For smaller businesses, the biggest mistake is the assumption that Microsoft 365 is secure out of the box. The recurring pattern looks like this:
The common thread is visibility. These environments are usually deployed correctly from a technical standpoint, but left unmonitored and unreviewed, so misconfigurations and attacker activity can sit undetected for weeks.
Eye Security’s incident responders see the same pattern across investigations. Threat actors rarely break Microsoft’s technology. They exploit weak identity controls, gaps in configuration, and a lack of monitoring. The recommendations below reflect what Eye Security applies and advises across affected customer environments.
Eye Security found that MFA was bypassed in 79% of investigated BEC cases, commonly through adversary-in-the-middle phishing and session theft. In one investigation, two unrelated threat actors compromised the same Microsoft 365 account within a week using AitM techniques. MFA therefore remains essential, but it must be supported by stronger authentication methods,
This does not mean MFA is ineffective. It still makes attacks significantly harder and should be enforced on every account. The point is, however, that MFA alone is not enough.
Conditional Access lets you require trusted or compliant devices, restrict risky sign-ins, and apply tighter rules to your most sensitive accounts, which directly limits the value of a stolen session or password.
Legacy authentication protocols do not support MFA challenges, which makes them a common route for identity abuse. Disabling legacy authentication at the tenant level removes one of the most reliable ways attackers bypass modern controls.
Not every employee needs access to every system or mailbox. Limiting permissions reduces the impact if an account is compromised. The more access an account holds, the more damage its compromise can cause.
Administrator accounts unlock critical systems and settings. They need additional protection.
Because threat actors operate as legitimate users, the clearest signals are behavioural. Eye Security recommends watching for and alerting on:
Disabling external auto-forwarding and alerting on new inbox rules are among the highest-value quick wins.
Retaining logs matters for two reasons. It supports faster detection, and it preserves the evidence needed for forensic investigation if an incident occurs.
Eye Security’s investigations repeatedly show that the breach was often well underway before anyone realised. Businesses should have a defined process to contain a compromised account quickly, before one inbox becomes a wider business incident. This means knowing in advance how to reset credentials, revoke active sessions, remove attacker-added MFA methods and forwarding rules, and determine what the attacker accessed.
One of the biggest misconceptions about cloud security is that once security settings are configured, the job is complete. In reality, Microsoft 365 environments are constantly changing. New users join, applications are connected, permissions evolve, and business requirements change. All the while, attackers continue developing new techniques.
Monitoring is what turns Microsoft 365’s raw telemetry into early warning. Done well, it surfaces the signals that precede a business-impacting incident: unusual login attempts, suspicious inbox and forwarding rules, unexpected data access, MFA prompts from unfamiliar locations, and account behaviour that only looks wrong when placed in context.
But telemetry alone does not stop anything. Microsoft 365 generates alerts, yet someone still has to investigate whether unusual behaviour is malicious, then act, revoking sessions, resetting credentials and containing the account, before an attack can escalate. The gap between an alert firing and someone acting on it is exactly where BEC unfolds.
Eye Security’s incident response data shows how much that gap matters. In environments without continuous monitoring, threat actors remained undetected inside BEC-affected networks for a median of 18 days. In environments with Managed Detection and Response (MDR), the median dwell time was 19 minutes.
In 19 minutes, a threat actor has barely begun. In 18 days, they can read emails, learn how the business approves payments, create inbox rules to hide their activity, compromise additional accounts, and step into a live supplier or invoice conversation, all from a trusted internal identity.
In BEC, detection speed is the single most important variable in limiting financial and operational impact.
The reason non-monitored environments run to weeks is that they rely on human discovery: a finance team noticing an anomalous payment, or a supplier calling to ask why the bank details changed. By then, the damage is often done. Continuous monitoring, automated detection and 24/7 human analysis replace that accidental discovery with deliberate detection, which is why Eye Security’s data shows BEC being surfaced and contained in a fraction of the time.
“In the BEC cases we investigated, MDR-enabled environments detected and contained incidents up to 99.9% faster.”
In modern identity-based attacks, the time between compromise and detection can determine whether an incident remains contained or escalates into a major business disruption.
Microsoft 365 remains one of the most secure productivity platforms available, but security is a shared responsibility.
In conjunction with the platform’s strong foundation, senior leadership must ensure identities are protected, configurations are regularly reviewed, and suspicious activity is detected quickly.
As threat actors now target people rather than infrastructure, effective security is no longer defined solely by prevention. It depends on how quickly a business can identify, investigate, and respond when something does not look right. And know who to rely on when they need to.
A lot can change in 12-months. Your business may have added new systems, suppliers, or employees. The amount of data you hold may have increased. Your security controls may have changed. And your current insurance policy may no longer offer the protection you think it does.
Cyber budgets have climbed every year for a decade. Attacks keep succeeding anyway. This gap tells us that the size of the budget was rarely the issue. September is when European leadership teams set the budget allocation for 2027. Every department competes for the same investment, and cybersecurity has to earn its place alongside the […]
The world’s most expensive cybersecurity systems have an awkward weakness. They trust the right people. And this is exactly what attackers are counting on.
