Defender for Office 365 can stop most of what lands in your users’ inboxes - if it is configured to. We assess and harden the platform you already pay for, enforce DMARC, and test the one layer no filter covers: your people.
Email security gets budget the week after it almost went wrong. Better a week before.
Finance caught it at the last step. Nobody wants to rely on that twice.
Your domain is being used against the people who trust it.
Missing DMARC and DKIM hurt delivery long before they hurt security.
And "we have Microsoft" is not an answer underwriters accept.
Or worse: they report nothing at all.
Documented, tested, and mapped - not assumed.
of successful cyberattacks start with a phishing email. It remains the front door, decade after decade.
reported lost to business email compromise in a single year - more than ransomware, by an order of magnitude.
Configuration first - it is the cheapest fix with the biggest drop in what gets through. Domain enforcement second. Then, and only then, test the people.
The filtering you already license, configured the way Microsoft’s strictest baselines intend - because defaults are tuned for delivery, not defense.
Most tenants have SPF and stop there. Full enforcement is what stops attackers from sending email as you - to your staff, your customers, and your suppliers.
Some attacks pass every technical control: a real account, a hijacked thread, a plausible ask. The only defense left is the human who pauses. We measure whether they do.
Business email compromise is not malware. It is a patient attacker, a real mailbox, and one changed bank account. Here is how it actually unfolds - and where each control gets a chance to break it.
No single layer stops this. Config narrows it, DMARC removes the easy version, and a trained human breaks it. That is why the assessment covers all three.
The reflex after a phishing scare is to buy another filter. But most organisations running Microsoft 365 already own enterprise-grade email security - unconfigured. A properly hardened Defender for Office 365 closes most of the gap a gateway is sold to fill, at zero additional license cost.
A vendor-thread hijack passes every filter, because technically nothing is wrong with it. The phishing simulation measures the layer that has to catch it: whether your people click, and, more important, whether they report.
Want the habit, not the snapshot? We run ongoing awareness programs that keep testing and training on a cadence.
One campaign, tailored to your organisation. A debrief with numbers your leadership will actually read. A retest after training to prove movement.
Same format as our full M365 assessment: board-ready, remediation-ready, and auditor-ready in one document.
Your domain can currently be spoofed, and the most likely BEC path, a payment-change email to finance, would reach the inbox. Both close with configuration: DMARC enforcement and impersonation protection, using licensing you already own. Simulation recommended for the finance and leadership teams once controls land.
records includedSame ground rules as every Falconer assessment - plus two that are specific to email.
No settings changed during the assessment. No agents, no user impact, no downtime.
Scoped, delegated read access via GDAP - granted by you, revocable by you.
When you approve fixes, DMARC moves monitor → quarantine → reject with your senders mapped first. Nothing breaks on day one.
Campaigns are scheduled with your IT, exclude critical windows, and collect no credentials - landing pages train, they never harvest.
Collection is hours, analysis is days. Findings arrive while they are still true.
Evidence handled under GDPR, stored in the EU, deleted on the schedule we agree.
This assessment runs standalone - fixed fee, sized by tenant - or as the email module of the full Microsoft 365 Security Assessment, which adds identity, collaboration, and posture in the same three-reader report.
Because Defender for Office 365 ships tuned for delivery, not defense. Impersonation protection, Safe Links policies, and strict presets exist in your license - most tenants simply never turn them on, or quietly bypass them with transport rules. Configuration is the product here.
Not the way we do it. We map every legitimate sender first - CRM, marketing platform, invoicing tools - then stage the rollout: monitor, quarantine, reject. Each step runs long enough to catch stragglers before tightening.
It is an optional add-on. The configuration and domain assessment is the base engagement; the simulation is priced separately, and honestly it lands best a few weeks after the technical fixes, so the test measures people rather than missing filters.
Never. Results are reported by department, not by individual. The metric we care most about is the report rate - the habit of forwarding something suspicious - because that is what ends real incidents early.
No. Landing pages train on the spot; they never harvest credentials. Campaigns are coordinated with your IT, scheduled around critical periods, and safe by design.
No single control can, and we will not pretend otherwise. Configuration narrows it, DMARC removes the spoofed version, and a trained human breaks the rest. The report also recommends process controls for finance, like out-of-band verification of bank changes - simple, and worth more than any filter.
Probably not. A hardened Defender for Office 365 covers what most gateways are sold to cover, at zero extra license cost. There are honest exceptions - multi-platform estates, archiving requirements - and if you are one, we will say so.
Same method, same report format, one surface instead of four. If email is the acute pain, start here. If you want identity, collaboration, and posture assessed at the same time, the full assessment includes this as its email module.
Days, not weeks - collection is hours, analysis takes a few days. It is a fixed-fee engagement sized by tenant and sender complexity, quoted before we start. The simulation add-on is quoted alongside if you want it.
Three honest paths: fix it yourselves with the included steps, have us implement the hardening and DMARC rollout, or fold email into ongoing management. The report stands alone whichever you choose.
A Microsoft security specialist reads every message and replies, usually within one business day. Whether you need monitoring, help with a specific tool, or just have a question, start here.
New to this? Ask about a free Microsoft security review as a starting point.
"*" indicates required fields