Cyber Security

Security writing tends to split into two useless halves: vendor material that implies a product solves the problem, and threat reporting that describes attacks without telling you what to configure. The articles in this topic sit between them. Almost every business we work with is defended primarily by Microsoft technology they already own, so the practical question is not which product to buy but which controls are switched on, tuned and monitored.

Identity is the first theme. Most breaches we see begin with a credential, not an exploit — a phished password, a token replayed from a session that was never bound to a compliant device, a legacy authentication protocol nobody disabled. The material covers Microsoft Entra ID hardening, conditional access design that survives contact with real users, multi-factor authentication rollout including the Authenticator setup questions staff always ask, privileged access and break-glass accounts, and access reviews.

The second theme is detection and response. Microsoft Defender XDR spans email, endpoint, identity and cloud apps, and it is only as good as its configuration and the people watching it. We write about Defender for Office 365 policy tuning, endpoint detection and response, what a security operations centre does between alerts, and how SIEM aggregation changes an investigation. Incident response gets covered as a process — containment, evidence, notification obligations under the Notifiable Data Breaches scheme, and the post-incident work that stops a repeat.

The third theme is the Australian baseline. The ASD Essential Eight remains the framework most local boards, insurers and government buyers ask about, and much of it maps directly onto Microsoft 365 configuration. Our guides explain each mitigation strategy in tenant terms, the maturity levels, and a realistic order to implement them in. Security awareness training, phishing simulation and the human layer are treated as part of the control set rather than an afterthought.