Security Blog
Insights, best practices, and threat intelligence from the SOClogix security team.
Microsoft 365 Attack Surface Guide: Where Attackers Target Your M365 Tenant
A technical breakdown of the 7 primary attack vectors threat actors use against Microsoft 365 tenants - email, identity, SharePoint, Teams, OAuth apps, Power Platform, and admin portals - with hardening steps for each.
By Matt Johnson
CMMC Level 2 in 90 Days: A Practical Roadmap for Defense Contractors
A 90-day phased roadmap for defense contractors pursuing CMMC Level 2 certification. Covers gap assessment, all 14 NIST 800-171 practice domains, SSP documentation, and C3PAO preparation.
By Matt Johnson
How to Evaluate an MSSP: 10 Questions Every Security Buyer Should Ask
A practical guide to evaluating managed security service providers. The 10 questions that reveal whether an MSSP can actually protect your organization - and the red flags that tell you to walk away.
By Matt Johnson
Tech Tip Tuesday: Wipe Before You Recycle
Old laptops, smartphones, and hard drives hold more than outdated files. They often store sensitive business data, logins, and financial records. If you dispose of a device without wiping it, you risk exposing that data to cybercriminals.
By Matt Johnson
Stop Phishing Emails Before They Hit Your Inbox
Cybercriminals still rely on phishing more than any other tactic to trick employees and gain access to business systems. If you're running a business with Microsoft 365, your inbox is the front line. Learn how to harden your anti-phishing policies.
By Matt Johnson
Attackers Are Abusing Microsoft 365's Direct Send to Send Internal-Looking Phishing
Our Incident Response and SOC teams detected a widespread phishing campaign leveraging Microsoft 365's Direct Send feature to spoof internal addresses and bypass standard email protections across financial services, healthcare, and manufacturing sectors.
By Matt Johnson
Tech Tip Tuesday: How IT Providers Can Safely Verify Users for Password Resets
When a user reaches out for a password reset, your support team becomes the gatekeeper. The recent Clorox vs. Cognizant $380M lawsuit illustrates the real-world stakes of failing to properly verify identities during high-risk account actions.
By Matt Johnson