In August, one phishing campaign hit more than 4,800 organizations with a single subject line: "Salary Review." Microsoft's threat intelligence team found that roughly 72% of the targets were professional services firms.
Here's what made it work. The email body was empty. The only thing in it was a Word document, and the only thing in the document was a QR code. Scan it with your phone, land on a page that looks exactly like a Microsoft sign-in, and you've handed over a live session — no password typed, no MFA prompt to make you stop and think.
Now ask yourself what your annual security training video would have done about that.
Most awareness training is a 20-minute cartoon about not clicking links from strangers. Your paralegal watches it in November and forgets it by December. In August she scans a QR code, because the subject line said "Salary Review" and she was, in fact, expecting a salary review.
Training that works looks different. Microsoft's attack simulation tooling in Defender for Office 365 can take real phishing messages your own tenant already caught, render them harmless, and send them to your team as a test. Same lure, same urgency, same sender style as the mail actually aimed at your firm. Then you see which group clicked — and you train those people, not everybody.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email