The journal
What we observe in tenants.
Field notes on Microsoft 365 security and corporate email. Not recycled industry news: what we actually observe, with the numbers and configurations behind it.
Email securityAugust 12, 20266 min read
Reaching p=reject without losing a single legitimate email
The method we use to take a domain from p=none to p=reject: in what order, at what pace, and the three mistakes that send everyone back to square one.
Read the article
Email securityAugust 5, 20264 min read
The SPF ten-lookup limit: the trap that breaks a domain while you fix it
Adding one more sender to your SPF record can make the whole domain fail at once, with no warning. How to know where you stand and how to come back down.
Read the article
Email securityJuly 29, 20264 min read
SPF, DKIM, DMARC: who does what, and why you need all three
Three mechanisms, three distinct jobs, and one expensive misconception: passing SPF does not mean passing DMARC. What each one checks, and where they complete each other.
Read the article
Microsoft 365July 15, 20264 min read
The six Microsoft 365 settings we find left open in almost every tenant
These are not vulnerabilities: they are defaults nobody ever closed. What they actually allow, and what it costs to close them.
Read the article
Microsoft 365July 1, 20263 min read
SharePoint external sharing: what your "anyone with the link" links still expose
A link created for a 2022 tender still works today. What anonymous sharing really exposes, how to measure it, and how to close it without blocking anyone.
Read the article
ComplianceJune 24, 20263 min read
What your cyber insurer will actually ask you
A cyber insurance questionnaire is not an audit: it hunts for four or five specific proofs. Knowing which ones changes the premium, and sometimes whether you are covered at all.
Read the article
ManagementJune 3, 20263 min read
Configuration drift: why your audit was right, and no longer is
An audit report describes an environment on a date. Six months later it describes something else. What moves, how fast, and what can be done about it.
Read the article
Reading is good. Measuring is better.
Thirty minutes to look at your own configuration rather than someone else’s.