You already own better email security than you've turned on

If your firm is on Microsoft 365 E3, you picked up a security upgrade on July 1 and almost nobody got told about it.

Here's the part most owners miss. Every Microsoft 365 mailbox comes with spam and known-virus filtering built in. That's your baseline, and it handles the obvious junk fine.

What it doesn't do is re-check a link after the email has already landed in the inbox, open an unfamiliar attachment in a sandbox first, or notice that a message signed "Dave" didn't actually come from Dave.

That's Defender for Office 365. It's been bundled with Business Premium for years, and as of July 1 Microsoft added it to E3 as well. Same mailbox, better filter, no new line item.

The catch: Microsoft switches on a basic layer automatically, but impersonation protection — the piece that catches the "can you get this wire out before 5" note that looks like it came from your managing partner — stays off until someone tells it which names and domains to watch.

For a CPA firm heading into year-end, that's the difference between a normal Tuesday and a very uncomfortable call to a client.

Worth a look before your next cyber renewal. Most firms already own this and have never switched it on.