Blog & Guides
Practical cybersecurity articles, step-by-step guides, and quick-reference cheat sheets — from Active Directory hardening to Microsoft 365 and zero trust. Written by someone who's done the work. No hype, no fluff.
Ghost Phishing: How the EvilTokens Campaign Hides in the Browser to Hijack Microsoft 365 Accounts
A new "ghost phishing" wave from the EvilTokens kit is slipping past email security by keeping its payload AES-encrypted until it renders in the victim's browser, then using Microsoft device-code phishing to take over Microsoft 365 accounts without ever stealing a password. This guide breaks down how the technique works, why traditional URL and email controls miss it, who is being hit, and the concrete detection and hardening steps to defend your tenant.
Copilot Cowork and Work IQ: Requirements, Cost, Use Cases and Setup for Microsoft 365 Admins
Copilot Cowork is Microsoft's agentic layer in Microsoft 365 Copilot — it sends emails, builds documents, schedules meetings and runs multi-step tasks with your approval — while Work IQ is the intelligence layer that grounds Copilot and agents in your tenant's data. This guide covers what each one does, the licensing and tenant requirements, how Copilot Credit billing works, real use cases, and step-by-step setup for admins and users.
Building a Microsoft 365 Incident Response Console in PowerShell
Why Microsoft 365 incident response is spread across three PowerShell surfaces and several portals, and how a single-file WPF console consolidates the first-hour actions — email purge via Purview, account containment via Graph/Entra, and BEC investigation — into one window. Includes the platform changes that broke a lot of scripts in 2025 and the open-source tool on GitHub.
Cloud Backup Best Practices for AWS, Azure, and GCP
A practitioner's guide to backing up cloud workloads the right way — the shared responsibility myth, the modern 3-2-1-1-0 rule, immutability and WORM, encryption and key control, cross-region and cross-account isolation, RPO/RTO, restore testing, and the native backup tools in AWS, Azure, and Google Cloud.
Third-Party Risk Management: From Onboarding to Offboarding (With Continuous Monitoring)
A practical, end-to-end guide to managing third-party and vendor risk across the full lifecycle — intake and tiering, due-diligence assessment, contracting, secure onboarding, continuous monitoring, periodic review, and secure offboarding — mapped to NIST SP 800-161, ISO 27036, the Shared Assessments SIG, and SOC 2.
Microsoft 365 E3 vs E5 vs E7: A Practitioner's Guide to Choosing the Right License in 2026
Microsoft 365 E3 covers core productivity and baseline security, E5 adds the advanced security, compliance and voice stack, and the new E7 'Frontier Suite' bundles E5 with Copilot, Agent 365 and the Entra Suite for AI-driven work. This guide breaks down what each tier includes, what it costs, and how to decide which one your organisation actually needs.
Okta to Entra ID Migration: A Phased Plan That Won't Lock Out Your Users
Migrate from Okta to Microsoft Entra ID in phases, not a big-bang cutover: sync identities, switch from Okta federation to managed authentication, move apps and provisioning one at a time with reverse federation as a safety net, then rebuild policies in Conditional Access before decommissioning Okta.
Why Your Emails Go to Spam (and How to Fix It): SPF, DKIM, DMARC and the 2024 Sender Rules
Emails land in spam mostly because of failed or missing authentication (SPF, DKIM, DMARC), weak sender reputation, and content or list problems. Since February 2024, Gmail and Yahoo also enforce authentication, one-click unsubscribe and a spam-rate cap. Here's how to diagnose and fix it.
Entra ID Conditional Access Gaps: 10 Misconfigurations That Quietly Defeat MFA
The most common Entra ID Conditional Access gaps are policies that exclude too much, sit in report-only forever, ignore legacy authentication, skip device and risk signals, and leave break-glass accounts unmanaged. Here's how to find and close each one.