Education / professional services
Ten incident investigations, zero accounts compromised
The situation
Running security operations for a Microsoft 365 environment doesn’t usually look like the Hollywood version of a SOC. It's a steady stream of triage — credential stuffing campaigns, W-2 phishing attempts targeting executives, brand-impersonation campaigns piggybacking on compromised SaaS providers, password sprays from rotating IP infrastructure, false positives during legitimate user travel. Across more than ten such investigations over recent months, the standing answer to "how many accounts were compromised" has been zero.
A representative incident
One of the more notable was a coordinated credential stuffing attempt that lit up the sign-in logs overnight: 3,440+ malicious authentication events from 93 distinct IPs spanning 32 countries. On a default-configured M365 tenant, that’s the kind of attack that produces compromised mailboxes, BEC fraud, and a very bad week. The defense was set before the attack started — that’s the actual story. Conditional Access enforcing MFA, blocking legacy authentication, and applying sign-in risk policies. Defender for Office 365 and Defender for Endpoint tuned and reporting. Email auth (SPF, DKIM, DMARC at p=reject) configured and monitored.
How I actually work an incident
Beyond the technical controls, the operational discipline matters. I phone the user before destructive containment — most security alerts are false positives, and an aggressive auto-response that locks out a real user during legitimate travel is worse than the alert itself. Every incident produces documentation: a Word incident report and Excel workbook, a refined response playbook, indicators of compromise added to detection. The cumulative result is a tenant that gets sharper over time rather than one that’s perpetually firefighting.
The outcome
Zero accounts compromised. Zero data loss. Zero business impact. A documented incident response practice — not a vendor’s playbook, the one I built operating this environment. The point of telling this story is not heroic incident response — it’s that the upfront configuration work, done correctly, plus the operational patience to verify before acting, makes heroic incident response unnecessary.
Want results like these for your environment?
Schedule a call