Our weekly email: one Microsoft 365, Copilot, Azure, or security move you can make this week, in plain English, for the people who run healthcare, legal, wealth, and CPA firms.
Microsoft 365 security
Most Microsoft 365 plans already include the protections firms buy twice — MFA, Conditional Access, Safe Links, Defender. They just ship dark.
The move this weekOpen your Microsoft Secure Score and read what it says. It is a list of protections you already own, ranked by impact. Turning on the top three items typically does more for your security than any product you could buy this quarter.
49 in the archive · newest first
Wealth management
Microsoft's own data says more than 99% of password spray attacks arrive through legacy authentication.
Legal
The FBI put out an alert this year about a crew that's been working U.S. law firms for about three years.
Healthcare
Microsoft is retiring text-message and phone-call sign-in codes. The clock started September 1.
Wealth management
Microsoft is now creating security policies inside your Microsoft 365 tenant for you — and it will turn them on whether you act or not.
CPA firms
Most of the CPA firms I talk to are already paying for security tools nobody ever switched on.
CPA firms
Microsoft says a single phishing campaign sent up to 100,000 emails in one day — every one of them dressed up as ChatGPT.
CPA firms
Two weeks out from the October filing deadline, the worst email problem a CPA firm can have isn't a full inbox.
CPA firms
Microsoft raised the price of most Microsoft 365 plans on July 1. Business Premium wasn't one of them.
Wealth management
Microsoft published something on September 9 that should change how you think about security training.
Wealth management
Microsoft published research in June that puts a price on your firm's credentials.
Wealth management
Microsoft shipped something last week that says a lot about where client data actually goes.
CPA firms
Most CPA firms I talk to assume the cloud-versus-server backup debate is settled.
Healthcare
Microsoft has retired the Virtual Appointments app in Teams, and most of the practices I talk to haven't noticed yet.
Wealth management
Here's the call nobody plans for: a client asks what an intruder saw in your email six months ago, and the honest answer is that the record is already gone.
Wealth management
Windows now turns on drive encryption by itself on far more laptops than it used to.
Legal
Microsoft made passkeys the default sign-in for Microsoft 365 on September 1, and the six-digit text codes your firm logs in with now have an expiration date.
Healthcare
NOAA's updated outlook puts this Atlantic season at a 75% chance of finishing below normal.
Legal
Microsoft's threat researchers published findings on September 2 that should change how your firm thinks about Teams.
Legal
Most firms that switch IT providers assume the old company's access ends when the invoice does.
Wealth management
A phishing service called BigBear 2.0 walked straight through multi-factor authentication at 258 organizations this month.
Wealth management
On September 1, Microsoft started moving Microsoft 365 users off text-message sign-in codes by default.
Healthcare
Microsoft's own playbook for turning on Copilot starts with a step almost everyone skips: fix who can see what, first.
Legal
Most of the cyber insurance conversations I have start with ransomware.
Legal
Microsoft stopped supporting Windows 10 in October 2025. Plenty of firms around here didn't replace those machines.
Healthcare
A Houston-based healthcare operator with 27 facilities across 12 states disclosed earlier this month that patient and employee information was stolen in an August…
Wealth management
Antivirus is still doing a job that stopped being the whole job about a decade ago.
Wealth management
In May, Microsoft published the breakdown of a breach that didn't involve a single piece of malware.
Legal
Microsoft shipped fixes for nearly a thousand security flaws last week.
Wealth management
In three days this past April, Microsoft tracked a phishing wave that reached more than 13,000 organizations.
Wealth management
Microsoft logged roughly 7.6 billion phishing attempts in a single quarter this year.
Healthcare
Microsoft shipped something in Intune's late-August update that most medical practices should care about more than they'll realize.
Legal
A crew researchers call Silent Ransom Group has been calling law firms and pretending to be their IT department.
Healthcare
In July, Health-ISAC warned healthcare organizations about a rise in attacks that start with a phone call instead of a hacked password.
Legal
On September 1, Microsoft started making passkeys the default sign-in method in Microsoft 365.
Healthcare
Microsoft's own tooling for merging two Microsoft 365 tenants moves your content.
Healthcare
Over three days in April, one phishing campaign hit more than 35,000 people across 13,000 organizations.
Legal
The FBI warned in May that an extortion crew has been calling law firms while posing as their own IT help desk.
Legal
The FBI put out an advisory this year about a crew that has been working U.S. law firms since 2023.
Legal
In March, Microsoft's security team published a breakdown of attackers abusing OAuth apps — those "Sign in with Microsoft" permission screens.
Small business
Microsoft's latest security report found that more than 97% of identity attacks are password attacks.
Legal
The FBI put out an alert this year about a crew that calls law firms pretending to be the IT department.
Wealth management
On June 1, Microsoft tracked a single business email compromise campaign that reached more than 67,000 people across 42,000 organizations in about three hours.
Wealth management
Microsoft's most recent Digital Defense Report has a number in it that should change how small firms think about security.
Microsoft 365 Copilot
Copilot doesn't leak data — it reveals the oversharing that was already there. Fix permissions before rollout, not after.
Cyber insurance
Insurers now want MFA, EDR, and tested backups attested in writing — and they check. Underwriting is a security audit with a premium attached.
Healthcare compliance
The controls the HIPAA Security Rule expects — access control, encryption, audit logging — already live in your Microsoft 365 tenant.
Financial · CPA
Microsoft 365 email encryption is a setting, not a product. Turn it on and stop trusting plain email with Social Security numbers.
Legal
A SharePoint client portal keeps privileged documents in one governed place — instead of scattered across inboxes you cannot control.