In early August, Microsoft tracked a single scam campaign that pushed more than a million emails in three days. Almost 88% of them landed in US inboxes.
The play was simple. An email that looked like it came from the CEO. A forwarded thread with the CFO already copied in. A software subscription invoice for just under $50,000, with the right company name typed into it. All of it pointed at whoever approves payments.
Nothing was hacked. No password was stolen. Someone just had a busy Tuesday and hit approve.
That's what I think about when a CPA firm tells me their team is "pretty good about that stuff." Pretty good is a feeling. You can actually measure it.
If you're on Microsoft 365 E5 or Defender for Office 365 Plan 2, attack simulation training is already sitting in your security portal. Paid for, and switched off in most tenants I look at. You send your own people a fake invoice email. You see exactly who clicks, who forwards it, who reports it. The ones who click get a five-minute training module instead of a wire you can't claw back. (E3 gets a limited trial version, worth knowing before you buy a third-party tool.)
Run it once a quarter. The first round is humbling. The fourth one is boring, which is the point.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email