Firewalls and antivirus software still dominate how people talk about cyber security, even though they protect a perimeter that stopped being the main point of entry years ago.
The exposure has moved into Microsoft 365 itself. Outlook holds years of client correspondence, while SharePoint and OneDrive carry contracts, financial records and HR files. Teams adds years of chat history on top, covering everything from client feedback to internal gripes about a supplier. One login unlocks all of it. Microsoft 365 has become the digital headquarters for a growing number of SMEs, and very few people have checked who still holds a key to the building.
What one login unlocks
A compromised Microsoft 365 sign-in doesn’t stay limited to one mailbox. Whoever gets hold of it inherits everything that login touches, from email history and shared files to the trust of colleagues who see a message from a familiar name and don’t think twice about opening what’s attached.
In practice, that often looks less like a dramatic hack and more like a quiet redirection. An attacker sets up a forwarding rule so a finance director’s incoming invoices get copied elsewhere without anyone noticing. Or they reply inside a live email thread with a change of bank details, timed to land exactly when a real payment is due. Pulling either off needs nothing more than already being inside the account.
Phishing remains the most common way in. It’s still the most reported attack type among UK businesses this year. Once someone is signed in as a real user, they aren’t breaking into separate systems one at a time. They’re already inside the headquarters, working out which door leads somewhere useful. It’s a pattern we’ve come across more than once among businesses we work with.
The doors nobody’s watching
Microsoft secures the infrastructure underneath Microsoft 365. What happens inside a business’s own setup, who has admin rights, which third-party apps have been given permission to connect, and whether multi-factor authentication applies to every user is down to the business itself. NCSC guidance is clear on this split. A platform can be secure by design and still be left open by how it’s configured, because those decisions sit with the customer rather than the provider.
Those decisions often go unchecked. An admin account gets created for a project and is never removed once the project ends. A trial app gets connected in the background, then forgotten. A shared login gets set up for a summer intern and stays live long after the intern has left. Then there’s a slower kind of drift. Someone leaves the company and keeps access to shared mailboxes and files for months afterwards, because properly switching off access takes more than deleting a password.
Multi-factor authentication gets switched on for new starters but was never applied retrospectively to the rest of the team, which may help explain why under half of UK businesses currently have any form of two-factor authentication in place, despite it being one of the simplest and most effective controls available. Checking Microsoft 365 configuration needs to be somebody’s specific, ongoing job, one that hasn’t been assigned yet at most SMEs.
Now everyone wants to see the locks
What customers, suppliers, insurers and auditors want to see from SMEs is changing. A customer’s procurement checklist, a supplier’s due diligence form, an insurer’s renewal application, and an auditor reviewing a client relationship all increasingly want a version of the same thing. They want multi-factor authentication switched on and someone named as responsible for security, ideally backed by an independent review from the last year.
It’s a shift SolCo has felt directly. We hold Cyber Essentials Plus certification and align our own security programme with the NCSC’s Cyber Assessment Framework, because clients and their own auditors increasingly expect to see it. Just over one in ten UK businesses currently review the cyber security risks posed by their immediate suppliers, so this kind of scrutiny is still inconsistent. Procurement teams and insurers are the two places it’s showing up fastest.
See inside your own headquarters
This is why SolCo built a complimentary Microsoft 365 Security & Compliance Review. It’s a way for business owners to see their own Microsoft 365 setup clearly, without needing to become an expert in it first. The review looks at the areas most likely to have drifted since it was first set up, including sign-in security, permissions, email protection, data sharing settings and device compliance. Findings get checked against the CIS Microsoft 365 Foundations Benchmark, a standard built with Microsoft and used as an industry baseline.
What comes back is short and written for the business owner, focused on what’s worth fixing first and why it matters. The same team delivering it handles IT support and Microsoft 365 for businesses across the region day to day.
An accurate picture of what’s currently configured, and a clear steer on what to fix first, is usually all it takes to close that shortfall. A business in Reading, or anywhere else in the Thames Valley, running day-to-day operations through Microsoft 365 can spare an hour to find that out, ideally before a customer, insurer or auditor comes asking for proof instead.
If Microsoft 365 already runs most of your business, that hour is worth booking now rather than after something has gone wrong. Book your complimentary Microsoft 365 Security & Compliance Review today and gain an independent view of how your setup aligns with modern security best practices.
