Article Summary: Cyber insurance applications have grown longer because of specific claim trends from 2023 and 2024 including the MOVEit supply-chain breach, the Change Healthcare ransomware incident and the Arup deepfake wire fraud. Each new section asks about specific security controls including immutable backups, layered MFA, callback verification on wires, EDR or MDR coverage, vendor risk and tested incident response. Answers that overstate your security posture can trigger rescission after a claim which means the policy is treated as if it never existed.
If you have a cyber insurance renewal coming up, the application is probably longer than the one you filled in last time. It is also more specific. Each new question maps to a control that (if missing) allowed a major 2023 or 2024 claim to escalate. The wording reflects how carriers responded to losses they paid in 2023 and 2024 and how you answer the form matters more than it used to.
This post covers why the application got longer, what each new section is asking, how to answer honestly without overstating your controls and what to fix in the 30 days before submission. The expensive mistake on a cyber insurance application is rescission where a future claim is denied because the carrier finds that the controls you declared were not in place at the time.
Why the Renewal Application Got Longer
The current generation of cyber insurance applications was shaped by three specific claim events from 2023 and 2024.
The MOVEit supply-chain breach surfaced on May 28, 2023 when Progress Software received the first reports of unusual activity from customers. The Cl0p ransomware group had been exploiting a previously unknown vulnerability in Progress Software's MOVEit Transfer file-sharing tool with activity detected by some researchers as early as February of that year. By late 2023, more than 2,650 organizations and over 66 million individuals had been affected with totals rising further into 2024. Carriers paid claims across that footprint and the experience reshaped how underwriters ask about third-party software risk.
Then the Change Healthcare ransomware incident in February 2024 froze US healthcare claims processing for weeks. The attacker gained network access on February 12, 2024 and deployed ransomware on February 21 with downstream impact on pharmacies, providers and patients across the country. HIPAA Journal's coverage noted that the absence of multifactor authentication on a key entry point made the initial intrusion possible. Industry analysts have estimated the cyber insurance loss from this single event at over $250 million and the response was tighter questions about backup immutability and incident response readiness.
The Arup deepfake wire fraud (also from early 2024) reframed how underwriters approach social engineering. A finance employee at the engineering firm's Hong Kong office transferred $25.6 million across 15 wires after a video call with what appeared to be the company's CFO and other executives (all of whom were AI-generated deepfakes). The fraud went undiscovered for about a week until the employee contacted Arup headquarters about a “secret transaction.” Out-of-band callback verification for wire transfers is now on every underwriter's checklist.
If you run an e-commerce store handling cardholder data, a healthcare practice with PHI, an accounting firm or law firm moving client funds or a real estate brokerage handling escrow, your application is the longest of all. You sit in the loss categories carriers got burned on.
The Backup Question Changed
The backup question on cyber insurance applications has tightened materially since 2023. What used to be a single yes/no question now asks whether those backups are immutable or air-gapped, when they were last tested and whether they can be deleted by your domain administrator credentials.
Expect wording on your form like: “Are backups stored in an immutable or air-gapped state, tested for restoration within the past 12 months and inaccessible to domain administrator credentials?”.
An immutable backup is one that nobody can delete or alter during a fixed retention window including someone using stolen administrator credentials. Air-gapped means the backup copy sits on infrastructure that cannot be reached from your production network. CISA's Stop Ransomware Guide lists immutable and tested backups as a baseline control which is the same standard most cyber insurance carriers now apply.
“Microsoft 365 backup” is no longer a passing answer on its own. Native Microsoft 365 retention isn't a backup in the sense the carrier means. Third-party backups that share the same identity perimeter as your production tenant can be wiped by a compromised global admin.
For the immutable backup question, the strongest answer references a backup platform with object lock or write-once-read-many storage enabled, an immutability window of at least 14 days (with 30 days now preferred), credentials separated from your production admin accounts and a recent successful restore test. Weaker answers describe daily backups to a NAS on the same network with no recent restore test which typically triggers follow-up underwriting and sometimes a premium adjustment. Answers that leave the immutability question unclear are the ones most likely to push a renewal toward sub-limits or non-renewal.
MFA Questions Go Deeper Than One Checkbox
MFA was once captured as a single yes/no question on most applications. The current generation asks whether MFA is enforced on email, VPN, remote desktop (RDP), all administrator accounts and privileged service accounts. The answer needs to be yes on all five for a clean pass.
SMS-based MFA is now treated as a weaker control. SIM-swap attacks and SS7 vulnerabilities have made text codes the weakest authentication factor available. Several carriers ask specifically whether your MFA uses an authenticator app, hardware token or push with number matching rather than SMS. If you are still on SMS for admin accounts, expect a follow-up question or a premium adjustment.
The privileged access management (PAM) question is the one most owners haven't seen before. PAM is a category of tool that keeps administrator credentials out of regular password managers. A PAM platform vaults privileged credentials, rotates them on use and logs every session which means a stolen admin password can't be used unnoticed for weeks before someone catches it.
A strong PAM answer describes a vaulting tool with credentials rotated on use and session logging enabled. Weaker answers like admin passwords stored in a shared password manager with annual rotation will usually trigger follow-up underwriting. Shared admin accounts that never rotate and produce no audit log of who used them are the configuration most likely to result in sub-limits or non-renewal.
Will cyber insurance be denied if you don't have MFA everywhere? Not always denied outright. Expect significant premium increases, sub-limits on ransomware coverage or exclusions for any incident that traces back to the unprotected entry point.
The Wire Transfer and Deepfake Verification Questions
After the Arup case and a string of business email compromise losses, carriers added callback verification questions to their applications. Callback verification means that before sending any wire above a defined threshold (commonly $10,000 or $25,000), the person authorizing the transfer calls the recipient at a phone number previously verified and stored rather than the number on the request email.
Expect wording like: “Does your organization require out-of-band verification using a previously known phone number for all funds transfer requests above [threshold] including requests appearing to come from executives?”.
Several current applications now ask separately whether staff have been trained on AI voice cloning and deepfake video risks. The Arup case made that question relevant for every carrier writing in professional services.
Accounting firms, law firms with escrow or trust accounts and real estate brokers will see this section scrutinized most carefully. Anyone moving other people's money is a soft target and an expensive claim when wire fraud lands.
A strong answer references a written wire transfer policy requiring callback verification to a verified number for transfers above a stated threshold, dual approval and annual social engineering training that includes deepfake awareness. Informal verification practice without a written policy will usually be flagged for follow-up. Wire transfers authorized by email approval alone are the configuration carriers are now declining to cover at all.
EDR, MDR and the End of the “We Have Antivirus” Answer
Traditional antivirus scans files against a list of known threats. Endpoint Detection and Response (EDR) watches behavior on each device and flags suspicious activity such as a process trying to encrypt files or escalate privileges. Managed Detection and Response (MDR) is EDR plus a 24/7 team watching the alerts and responding when something fires at 2am on a Sunday.
Current applications ask whether you have EDR deployed, whether it covers 100% of endpoints including servers and whether a 24/7 security operations center (SOC) monitors and responds to alerts. The MDR question is increasingly yes or no and the no answer has pricing consequences.
If you don't have MDR yet but plan to add it, say so plainly with a timeline. Underwriters can work with “MDR deployment scheduled for Q2 with vendor selected”. They cannot work with vague answers about future plans.
The Vendor Risk Questions
Supply chain questions used to be a single yes/no item. After MOVEit and Change Healthcare, carriers now want a full section on the software vendors holding your data.
Expect questions like: “List your top five software vendors with access to sensitive data and confirm whether each provides a SOC 2 Type II report or equivalent.” If you have never asked your practice management software vendor for a SOC 2 report, that conversation is overdue.
You are not expected to audit every vendor's security program in detail. The carrier wants to see that you know who your top vendors are, what data they hold and that you have asked the basic questions like SOC 2 attestation. An honest “we have identified our top five vendors and requested SOC 2 reports from three with two outstanding” reads better than a confident answer that falls apart in discovery.
The Mistake to Avoid: Misrepresentation and Rescission
The most expensive answer on a cyber insurance application is the one that overstates the security controls you have in place. Cyber insurance applications are warranty documents. If a forensic investigation after a claim finds your environment didn't match what you declared, the carrier can rescind the policy.
Rescission means the policy is treated as if it never existed, your claim is denied and any prior payouts under the same policy term can be clawed back. Some courts have found that the carrier doesn't need to prove a direct link between the misrepresentation and the loss. The misrepresentation itself is enough.
The cleanup approach is direct. If a question asks about MFA on all admin accounts and you have a gap, declare the gap and include a remediation date. Carriers reward honest gaps with a plan more than they reward polished answers that don't survive forensic review.
Checking “no” or “in progress” on the form may raise your premium or tighten your coverage terms. That cost is predictable. Misrepresentation discovered after a claim can void the policy entirely and the timing means you absorb the full incident cost yourself.
The 30-day Pre-Renewal Checklist
Work through this in order. Most items are achievable in a month if you start now.
Week 1. Confirm MFA on email, VPN, remote desktop, all administrator accounts and any service accounts that support it. Move admin MFA off SMS to an authenticator app or hardware token.
Weeks 1 to 2. Verify your backups are immutable or air-gapped. Run a test restore and document the result with date and screenshots.
Week 2. Write a one-page wire transfer policy requiring callback verification to a previously verified phone number for any transfer over your chosen threshold. Get it signed by anyone who can authorize payments.
Weeks 2 to 3. Confirm EDR is deployed on every endpoint and server. If you only have traditional antivirus, get quotes for EDR or MDR now so you can answer with a deployment timeline.
Week 3. Identify your top five software vendors and request SOC 2 reports or equivalent attestations. Note who responded.
Weeks 3 to 4. Document or update your incident response plan and then run a 60-minute tabletop exercise with your leadership team. Keep the notes. That is your “tested in the past 12 months” evidence.
Week 4. Sit down with the application and answer honestly. Flag anything you couldn't fix with a specific remediation date.
Article FAQs
What does rescission mean on a cyber insurance policy?
Rescission means the carrier voids the policy from inception after discovering material misrepresentation on the application. The policy is treated as if it never existed, the current claim is denied and any prior payouts under the same policy term can be clawed back.
Will my cyber insurance be denied if I don't have MFA on everything?
You are not always denied outright. Expect a significant premium increase, sub-limits on ransomware coverage or exclusions for incidents that trace back to the unprotected entry point. The most common gap is MFA on privileged or service accounts.
What is the difference between EDR and MDR on an insurance application?
EDR (Endpoint Detection and Response) is the technology that watches device behavior and flags suspicious activity. MDR (Managed Detection and Response) is the same technology plus a 24/7 team watching the alerts and responding. Carriers increasingly want both and the application often asks about each separately.
Why are cyber insurance renewal applications longer than they used to be?
Carriers added detailed sections in response to specific 2023 and 2024 losses including the MOVEit supply-chain breach, the Change Healthcare ransomware incident and the Arup deepfake wire fraud. Each event drove changes to backup, MFA, vendor risk or wire transfer questions on subsequent applications.
Can my cyber insurance claim be denied if I answered the application incorrectly?
Yes. Material misrepresentation on a cyber insurance application can trigger rescission which voids coverage retroactively. Many courts have found that the carrier does not need to prove a causal link between the misrepresentation and the specific loss.
What does immutable backup mean on a cyber insurance application?
A backup that cannot be modified or deleted for a defined retention period even by someone using stolen administrator credentials. Cloud object lock and write-once-read-many storage are common implementations. Most carriers want a window of at least 14 days with 30 days now preferred.
Article Summary: Offboarding is the final step of a process that started on the employee's first day. Shared logins, forgotten SaaS subscriptions, untracked personal devices and client relationships locked inside one person's inbox are almost always traceable to informal onboarding shortcuts taken months earlier. Tightening the onboarding side turns each future departure into a 90-minute checklist instead of a three-week cleanup.
By the time an employee hands in their notice, the decisions that will make their departure clean or messy have already been made. They were made in the first weeks of the person's tenure when nobody was paying close attention because the new hire had just arrived and there were a hundred other things to do. A shared login here, a quick SaaS sign-up there or a personal laptop used until the company hardware arrives are all things that happen often when you are trying to get someone started as soon as possible. By month six, none of those feel like decisions at all. They feel like how things are.
This post covers what is really going wrong when offboarding takes three weeks, the four onboarding shortcuts that guarantee a painful exit, how to retrofit hygiene on the team you already have and what your IT provider should be doing at onboarding that probably isn't happening.
What is really going wrong when offboarding takes three weeks?
A clean offboarding takes about 90 minutes of IT time. An account is disabled in your identity provider which cascades access revocation across every tool connected via single sign-on. The device is remotely wiped or collected and wiped on-site. Email is forwarded to a manager or converted to a shared mailbox. The departing person's accounts in your CRM and project tools are reassigned. A handover note (already templated because it was templated at onboarding) gets filled in and filed.
The messy version of the same process can take three weeks. It starts with a manual list of tools nobody can fully remember which usually means asking the departing employee to help reconstruct it. You find a Figma account, a Loom workspace, a Notion instance and an Airtable base all set up independently and all with passwords sitting in the departing employee's personal password manager. The laptop is at their house and they are not in any rush. A client emails to say they received a strange message from a personal address. Six weeks later a vendor charges the company card for a seat that you thought you cancelled.
Whether your offboarding is clean or chaotic depends on what was set up during onboarding.
In the identity management world, this is called the “joiner, mover, leaver” lifecycle. Microsoft and most identity vendors use the same three-phase model. A rushed joiner phase compresses months of identity cleanup into the two weeks after the resignation lands.
Four Onboarding Shortcuts That Guarantee a Messy Exit
Letting New Hires Sign up for SaaS Tools On Their Own
When a staff member signs up for a tool independently using their work email and a password only they know, that account is functionally theirs. You can't reset it without triggering a notification to them. You may not even know the account exists until a vendor invoice shows up or until the account goes dark after they leave and a client project breaks.
This is the most common source of the “we can't find half the logins when someone leaves” problem. The fix is provisioning every tool through a central identity system where any new SaaS application gets connected to your single sign-on before the first user logs in.
Tolerating Personal Devices “Just Until We Get Them Sorted”
Personal devices that get used for work don't stay temporary. The employee installs apps, connects to client systems, downloads files and what was a temporary fix becomes how they work permanently. When they leave, you have no ability to wipe company data from a device you don't own and never enrolled in a management system. You are relying on their goodwill (which is usually fine) but it is not a security control.
The fix is to issue company-owned devices on day one and enroll them in mobile device management. When you do allow a personal device, require managed app access for company email and files. Browser-saved credentials are not a substitute.
Shared Logins for Tools You Didn't Want to Pay Per-Seat For
Shared credentials are the worst offender at offboarding. When five people use the same login for a tool, you can't remove one person's access without changing the password for everyone. You usually find this out at the worst possible time when the person leaving is the one who set up the account and nobody else remembers the password at all.
Per-seat is the cost of doing this properly. The savings from shared logins reappear during offboarding as wasted hours and exposed access.
Letting Client Relationships Live in One Person's Inbox
This one is specific to agencies and professional services. When a senior account manager or consultant leaves, their client relationships often leave with them. The context, the email history, the preferences and the half-finished threads lived in one person's inbox. With the person gone, all of that becomes inaccessible or awkward to retrieve.
From the client's side, your business just doesn't know who they are anymore.
The fix is a shared inbox or CRM where client communication is logged. Even a Microsoft 365 shared mailbox with a clear expectation that client threads are CC'd to it is a meaningful improvement over what most small businesses have today.
How to Retrofit Hygiene on the Team You Already Have
The cleanup most businesses need is for the team they already have before the next hire arrives. You can't go back and re-onboard your existing staff but you can audit what is there and close the gaps before the next departure.
The SaaS Audit
Pull three months of credit card statements (every card that gets used for business expenses) and list every recurring SaaS charge. For each one, find out who set it up, who has the login, whether the account uses a personal or company email and whether anyone else can access it if that person left tomorrow.
You will find tools nobody remembers signing up for, tools used by one person with no backup access and accounts where the original owner has already left while you are still paying for the seat. None of this is a technical exercise. All it takes is a spreadsheet and an afternoon.
The Device Register
Build a simple list: who has what, when each device was issued, whether it is enrolled in a management system and what company data each device can access. If you don't have one, build it now. Ask every staff member to confirm the devices they use for work (including personal ones). The goal is to map what you are working with. Most employees are happy to confirm what device they use once they know nothing punitive will come of it.
For any personal device that has been used to access company systems, the minimum is making sure company email and file access happens through managed apps that can be remotely disconnected.
Client Communication in Shared Places
Move client communication into shared places so the relationship belongs to the business when an individual moves on. Continuity is the goal. Set up a shared inbox or alias for client-facing communication and use a CRM where contact history and notes are logged. Even a shared Microsoft 365 mailbox with a clear expectation that client threads are CC'd to it is a meaningful improvement over what most small businesses do today.
What Your IT Provider Should be Doing at Onboarding
Most IT providers get called when someone resigns. They show up, disable the account, collect the laptop if they can find it and do their best with whatever documentation exists. That is the wrong end of the lifecycle to be involved in. If that is the only time your IT provider is involved in staff transitions, you are not getting much value from the relationship.
The model that works puts your IT provider at onboarding too. They set up the new account in your identity provider, enroll the device in your mobile device management system and provision access through single sign-on so every tool the new hire uses is connected to a central identity that can be switched off in one action. They should also maintain a handover document for each staff member that is updated periodically and lists every system the person accesses and every client relationship they own as well as every credential tied to their identity.
When that is in place, offboarding becomes a checklist and an hour rather than a three-week excavation. Ask your IT provider what they do at onboarding. If the answer is “not much” or “we usually just get called when someone leaves” that is worth a conversation.
A 60-Day Plan Before Your Next Round of Departures
You don't need to know the exact date of the next resignation to start. The work is more manageable when nothing is urgent.
Weeks 1 and 2: Run the credit card SaaS audit. Build a list of every tool, every account owner and every login that only one person controls. Flag the ones where access would be lost or complicated if that person left this week.
Weeks 3 and 4: Build the device register. Confirm what every staff member uses for work. For personal devices with company access, implement managed app access at minimum. Enroll company-owned devices in a management system if they aren't already.
Weeks 5 and 6: Audit client-facing communication. Identify any client relationships that exist primarily in one person's inbox or on someone's mobile phone. Set up shared mailboxes or CRM logging for the highest-risk accounts first.
Weeks 7 and 8: Write the onboarding process you wish you had when you started. Use everything you found in the previous six weeks as the input. Apply it to your next hire from day one and use it as the template for a handover document for every existing staff member.
Most of this is an operational task rather than a technology project. A spreadsheet, some honest conversations with your team and a few hours of your IT provider's time will cover the bulk of it.
Article FAQs
How long should offboarding take in a small business?
With proper onboarding hygiene and centralized identity, the IT side of offboarding takes about 60 to 90 minutes. Take that foundation away and the same task can stretch to two or three weeks of scattered cleanup.
How do I find SaaS tools my team signed up for without telling me?
The fastest way is a three-month review of every credit card statement used for business expenses. Most shadow SaaS shows up as a recurring charge somewhere on the card.
Can I wipe a personal device after someone leaves?
Only the company data and only if you set that up while they were still employed. Mobile device management or managed app access lets you remove company email, files and credentials from a personal device without touching the rest of it. If those tools were not in place during their employment, your options are limited.
What is the role of single sign-on in offboarding?
Single sign-on means every tool a user accesses is tied to a central identity. Disabling that identity in one place revokes access everywhere. Without single sign-on, you have to manually log into each platform and remove the user.
Should I make my employees use only company devices?
Where practical, yes. For personal devices, enrolling them in a management system or requiring managed app access is the next best thing. A personal device with saved company credentials and no management is the highest-risk configuration for offboarding.
Article summary: Retired laptops, old servers and decommissioned drives often carry more recoverable business data than most owners realize even after a factory reset or a quick reformat. Secure IT asset disposal replaces those quick fixes with verified data destruction and documentation before equipment ever leaves the building. Without it, e-recycling an old computer can quietly turn into your next data breach.Read more
Article summary: Weak network printer security lets attackers use these overlooked devices to move deeper into a business network or pull stored documents straight off the machine. A short list of configuration and maintenance habits closes most of that exposure without replacing any equipment.Read more
Article Summary: Microsoft 365 Copilot retrieves files, emails and chats using each user's existing Microsoft 365 permissions. In most tenants, those permissions are broader than anyone has mapped because access accumulates across years of projects and staff changes. A safe Copilot rollout begins with auditing those permissions, fixing the gaps and applying sensitivity labels to confidential content. Microsoft publishes specific guidance on this cleanup structured into a pilot, deploy and operate sequence.
A safe Microsoft Copilot rollout starts with a permissions audit before any trial license is enabled. Microsoft 365 Copilot retrieves files, emails and chats using each user's existing Microsoft 365 permissions. In most tenants, those permissions are broader than anyone has mapped because access tends to accumulate across years of projects, ad-hoc sharing and staff changes. Microsoft itself now recommends a specific cleanup before any trial. Map who currently has access to what, fix the permissions that have drifted out of scope and apply sensitivity labels to confidential content.
This post covers what Microsoft 365 Copilot does with permissions, where oversharing tends to show up in a typical tenant, the kinds of content Copilot can return when permissions are broad, how to run the audit Microsoft recommends and what to fix before any rollout.
How Microsoft 365 Copilot Accesses Your Data
Copilot answers questions and generates content by retrieving information through Microsoft Graph which is the API layer that ties together your Microsoft 365 services. When a user asks Copilot a question, it pulls from emails, calendar items, SharePoint documents, OneDrive files, Teams messages and meeting transcripts that the signed-in user has permission to access.
The critical phrase in Microsoft's own documentation is short. Copilot can only summarize or reference content that the user is authorized to access.
That statement is accurate and it is also where the risk sits. The variable is whether each user's permission set still matches what you assume it covers.
Why Permissions Tend to be Broader Than Anyone Thinks
For a manufacturer or trades business, most of the data sitting in your Microsoft 365 tenant is operational. Inventory records, production schedules, supplier contracts and project files. Some of it is sensitive but the consequences are usually contained when the wrong employee reads a document.
At a professional services firm, the dynamic is different. The files are the product itself. Client matters, settlement figures, fee arrangements, deal terms, financial data and employment records make up the deliverable and the confidentiality of that material is the whole business model. Yet the same files often live in environments that were never properly scoped.
The reason is structural. “Just give them access for the Henderson matter” is how it starts. The matter closes, the access is never removed and eighteen months later that person has read permissions on a folder they have no current reason to be in. Multiply that across five years of staff changes, project onboarding, ad-hoc Teams channels and external sharing links that never expired. The result is a permission environment that nobody fully understands.
If the permission exists, Copilot can use it. Whether it was granted with appropriate scope is not part of the calculation.
Microsoft now acknowledges this directly. The company publishes a deployment blueprint for Copilot rollouts that organizes the work around three pillars: remediate oversharing, set up guardrails and meet AI regulatory requirements. Microsoft's own guidance puts oversharing remediation first because it is the pillar that has to be addressed before any rollout produces a useful result.
What Copilot Can Return in a Tenant with Broad Permissions
Five examples of what Copilot can return when broad permissions exist and have not been audited:
“What is everyone's salary?” Returns the compensation spreadsheet HR shared with a hiring manager during a recruitment process eighteen months earlier. The file remained shared after the hiring manager got promoted.
“Summarize the [client] case.” Pulls content from a SharePoint site set up for a different team. A user added during a one-off project two years ago still has the permission that was never removed and Copilot returns a summary of the case to them.
“What deals are we currently working on?” Aggregates content from M&A data rooms that were never properly closed, pipeline trackers in personal OneDrives that got shared once for a partner meeting and prospect lists sitting in a Teams channel that grew beyond its original membership. The output is a single consolidated view of the firm's commercial pipeline.
“Find everything mentioning [former employee].” Surfaces the termination memo, the severance calculation, the performance review that preceded the exit and any email threads saved to SharePoint. Material that was never intended to be findable below partner level shows up in one query.
“What is our markup on [client] engagements?” Outputs the internal pricing sheet that was shared during a proposal process so two people could review it. The link was never restricted, the file was never moved and the numbers come back when Copilot is asked.
The question of who would ask any of these queries is separate from the question of what Copilot can return. Microsoft's deployment guidance focuses on what Copilot is capable of returning and recommends a permissions review before Copilot is enabled at any scale.
Why a “Small Pilot” is Rarely as Contained as People Think
Running a limited pilot feels like a safe middle ground but the way most firms set them up tends to produce the highest-risk version of the trial.
The three or four people picked for a pilot are almost always senior. Senior staff have the broadest access of anyone in the firm which means any searches they run have the widest possible scope. A pilot with three senior partners produces a higher-risk preview of Copilot than a pilot with three junior staff.
And pilots drift. Licenses get reassigned when a partner decides they are not using one. The person who ends up with the license is often whoever asked most recently which is not the same as whoever has the most appropriate access profile.
Microsoft's audit logs will show you what was asked after the fact but the asking cannot be reversed. Once a Copilot summary has been returned to a user, that information cannot be recalled.
The Cleanup That Should Happen Before Any Trial
Before you click “start trial,” four pieces of work make the difference between a useful test and a disclosure event.
SharePoint sharing audit. SharePoint Advanced Management includes a content management assessment that surfaces permission issues, oversharing patterns and inactive sites. If your tenant has never been reviewed, this is the first place to look. The report identifies which sites are shared more broadly than they should be.
OneDrive external share review. Look at files shared outside the organization that were never recalled. These are particularly common in legal and accounting firms where files get sent to clients for review and then forgotten.
Teams membership review. Confirm that channel membership still reflects who should have access to the files stored there. Channels that grew during an active project and were never trimmed are a frequent source of unintended access.
Sensitivity labels for confidential content. Microsoft Purview sensitivity labels are the mechanism that tells Microsoft 365 which content is confidential. Once applied, you can use Data Loss Prevention policies to exclude labeled items from Copilot processing and use encryption settings that block Copilot from reading the content at all without explicit permission. Without sensitivity labels in place, Copilot has no way to treat a client settlement document differently from a catering invoice.
These four pieces of work generally take four to eight weeks for a firm in the 25-to-100-person range. Some of it can be done by your IT provider. The most sensitive parts (like deciding which document categories deserve which sensitivity label) are best handled with input from the partners or owners who understand the material.
The One Question to Send Your IT Provider
Before you make any decision about Copilot, send this to whoever manages your Microsoft 365 environment:
“Can you show me a report of every file in our tenant that is accessible to more than ten people and flag the ones containing client names, salary figures or financial data?”
If they can produce something useful within a few days, your environment has been managed actively. The report will not be a perfect audit but it will show you the shape of the problem and give you a starting point.
If the answer is “we would need to enable some things first” that itself is informative. It means the SharePoint sharing reports have never been run and the tenant has never been reviewed from a permissions perspective. That is the real answer to your Copilot readiness question and the audit needs to happen before any trial does.
Article FAQs
Does Microsoft 365 Copilot have access to my files by default?
Copilot has access to whatever the signed-in user has access to and it is scoped by Microsoft Graph and existing SharePoint, OneDrive and Exchange permissions. Copilot cannot reach files outside the user's existing permission set.
Can sensitivity labels stop Copilot from reading certain files?
Yes. Microsoft Purview sensitivity labels with encryption can block Copilot from reading the content. Files require the user to have specific usage rights (EXTRACT and VIEW) for Copilot to interact with them. Data Loss Prevention policies can also exclude labeled items from Copilot processing.
Is a small Copilot pilot a safe way to test it?
A pilot is fine if the pilot users have limited access to sensitive content. The common mistake is running a pilot with senior staff who tend to have the broadest access in the firm.
How long does it take to prepare a tenant for Copilot?
For a firm with several years of accumulated content, the preparation usually takes four to eight weeks. The work involves a SharePoint sharing audit, an external share review, a Teams membership review and sensitivity label application.
What does Microsoft say about Copilot oversharing risk?
Microsoft publishes a deployment blueprint that organizes Copilot security work around three pillars: remediating oversharing, setting up guardrails and meeting AI regulatory requirements. The oversharing pillar is the one that should be addressed before any Copilot trial.
Article Summary: Microsoft has tightened several Microsoft 365 defaults over the past few years but those changes do not always apply retroactively. Tenants set up before 2022 or configured by a previous IT provider and left alone since often still have legacy settings in place around file sharing, external email forwarding, third-party app consent, audit log retention and MFA enforcement. Five settings worth verifying.
Microsoft has tightened several default settings in Microsoft 365 over the past few years. Newer tenants get more protection out of the box than tenants set up before 2022 or so. The problem is that legacy configurations stay in place. A setting changed for new tenants in 2024 doesn't retroactively change in yours and historical user consents, inbox rules or sharing links granted before the change are still active.
Here are five settings worth checking in your tenant (especially if it is more than two or three years old, was set up by a previous IT provider or has not been audited in a while).
A few caveats before we start. Some of these settings require Microsoft 365 Business Premium, E3 or E5 licensing to change so if a toggle is grayed out, your license tier is most likely the reason. A couple of these changes will generate support tickets from your team because they change how something already works. None of them need to be flipped all at once.
1. The Default Sharing Link in SharePoint and OneDrive
When someone in your organization shares a file from SharePoint or OneDrive, the link they generate has a default scope. In tenants set up before Microsoft tightened the new-site defaults, that scope is often “anyone with the link” which means anyone who receives the URL can open the file without signing in. No expiration. No record of who else the link was forwarded to.
Newer Teams-created sites now default to “Only people in your organization.” Older sites and the tenant-level setting often still allow Anyone links. A departing employee who emailed a proposal to their personal account six months ago still has a working link unless someone manually revoked it.
The default sharing link type sits in the SharePoint admin center under Policies > Sharing. Switching the tenant default to “Specific people” forces every new link to require authentication. You can also set a maximum expiration for any remaining “Anyone” links so they time out automatically.
Rough time to change: 15 minutes. This has no impact on existing links until they are regenerated.
2. External Email Forwarding Rules
Microsoft now blocks automatic email forwarding to external addresses at the tenant level by default through the outbound spam policy. This rolled out as part of Microsoft's secure-by-default effort.
Forwarding rules created before that change can still be active and tenants with custom outbound spam policies configured years ago may not reflect the current default. A user who set up a rule a few years ago to forward every email to a personal Gmail address may still be exporting your data depending on how their rule was constructed and whether it predates the policy.
Verify two things. In the Microsoft Defender portal, under Email & Collaboration > Policies & Rules > Anti-spam policies > Anti-spam outbound policy, confirm the “Automatic forwarding rules” setting is set to “Off” or “Automatic - System-controlled.” Then audit existing inbox rules across your users for any forward-to-external configurations. The Microsoft Purview audit log lets you search for inbox rule creation events.
Rough time: 10 minutes to verify the tenant setting but longer to review existing rules across all mailboxes.
3. Historical Third-Party App Consents
A Microsoft-managed user consent policy was enabled by default in July 2025 which prevented users from consenting to most third-party applications that request access to their files and sites. New consent requests now route to an admin for review.
The change applies going forward. Apps that were granted user consent before the policy took effect still have whatever permissions they were given including the ability to read mail, calendars and files on behalf of the user. Some of those apps may be tools an employee installed years ago and no longer uses or apps installed during a one-off project that nobody remembers approving.
To review what is already there, go to Microsoft Entra ID > Enterprise Applications > All applications. Sort by user consent and look at what currently has access to mail, files or calendars. Anything you don't recognize or no longer need can be revoked from the same screen.
Rough time: 30 to 60 minutes for the review depending on how many historical apps are in the list.
4. Mailbox and Tenant Audit Log Retention
The default audit log retention period in Microsoft 365 changed in October 2023. Audit (Standard) logs are now retained for 180 days (up from the previous 90 days). Customers with E5 licensing or the Microsoft Purview Audit (Premium) add-on get one year of retention for Exchange, SharePoint, OneDrive and Entra ID audit records with other activity types staying at 180 days.
If you are in healthcare, financial services, legal or any other regulated industry, 180 days may not match your retention obligations. HIPAA, the FTC Safeguards Rule, and most state bar rules around client data assume you can produce records on request and the relevant period is often measured in years rather than months.
Audit retention policies live in the Microsoft Purview compliance portal under Audit > Audit retention policies. Extending retention beyond 180 days requires E5 or the Purview Audit add-on. The configuration itself takes about 15 minutes once you have confirmed your license supports it.
5. MFA Enforcement and Security Defaults
MFA enforcement is the area most likely to be inconsistent in older tenants. Microsoft introduced Security Defaults in late 2019 and the feature now enforces MFA automatically on new tenants. Microsoft has also been progressively making MFA mandatory for admin actions in the Microsoft 365 admin center and Azure portal through 2024 and 2025.
Tenants created before Security Defaults rolled out may have no baseline enforcement. There is also a common configuration trap. When an admin enables a Conditional Access policy which is available with Business Premium and above, Microsoft expects you to take over MFA enforcement through that policy and may turn Security Defaults off. If the transition was done quickly, you can end up with Security Defaults off and a Conditional Access policy that doesn't cover every user.
Check three places. In the Entra ID admin center under Properties > Manage Security Defaults, confirm whether Security Defaults is on or off. Under Protection > Conditional Access, confirm a policy is actively enforcing MFA for all users (including administrators). Pay particular attention to break-glass admin accounts which are sometimes excluded from Conditional Access for emergency access reasons and left with no MFA as a result.
Rough time: About an hour or longer if Conditional Access has been configured with several existing policies you need to map.
A Sensible Order to Roll the Changes
Some of these changes are silent to your users. Others change how something they do every day works.
Audit log retention (#4) and the historical app consent review (#3) carry no user-facing impact. Start there.
Verifying external forwarding (#2) is silent unless someone has a legitimate forwarding rule which is rare. Do this next.
The sharing default (#1) will eventually generate user questions and particularly from anyone used to clicking “share” and pasting the link into an email. Communicate the change before you flip the tenant setting.
The MFA and Conditional Access review (#5) is the highest-stakes change and the one most likely to lock people out if it is done badly. Save it for last and budget the time to do it properly.
Article FAQs
Are my Microsoft 365 settings still vulnerable if my tenant was set up recently?
New tenants get more protection out of the box than tenants set up a few years ago. Even so, certain settings including sharing scope, app consents granted by users and historical inbox rules need to be reviewed in any tenant regardless of age.
What is the current Microsoft 365 default for “Anyone with the link” sharing?
At the tenant level, many existing tenants still permit “Anyone with the link” sharing. Newer Teams-created SharePoint sites default to “Only people in your organization.” Verify both the tenant-level setting and the site-level setting if you want to know what your users see in practice.
Did Microsoft turn off external email forwarding by default?
Yes. Microsoft's outbound spam policy now blocks automatic external forwarding by default at the tenant level. Existing inbox rules created before that change may still be active and worth auditing.
How long are Microsoft 365 audit logs kept by default?
180 days for Audit (Standard) as of October 2023. One year for key workloads (Exchange, SharePoint, OneDrive, Entra ID) if you have E5 or the Microsoft Purview Audit (Premium) add-on.
Does Security Defaults cover all my users?
On a new tenant, including MFA enforcement. On an older tenant that has had Conditional Access policies enabled, Security Defaults may have been turned off and MFA coverage now depends on how Conditional Access has been configured.
Contact us if you need any help with your Microsoft 365 settings.
Article Summary: Personal web habits are one of the least visible cybersecurity risks businesses face when work and personal life share the same devices, browsers and identities. Routine behavior like checking personal email, reusing passwords or signing into familiar apps can expose business data without anyone intending it. The safest approach reduces exposure with clear guardrails, stronger defaults and practical coaching rather than restrictive rules that drive workarounds.
Most cyberattacks do not start with a sophisticated intrusion. They start with a click on a personal email, a reused password or a file uploaded to a familiar cloud service because the approved option felt slower.
The Verizon Data Breach Investigations Report found that 68% of breaches involve the human element.
Not a zero-day exploit. Not a brute-force attack on a hardened system. Human behavior in the course of an ordinary working day.
For businesses running cloud-based workflows across multiple devices, the personal and professional overlap is now the rule. Understanding where that overlap creates risk is no longer optional. It is a core part of modern security strategy.
The Risk Sitting Outside Your Security Stack
Personal web habits are not reckless behavior. They are normal behavior.
Checking a personal inbox on a work laptop. Logging into a social account during a break. Saving a work password in a browser already loaded with personal accounts. Uploading a document to a storage service because it is faster than the approved option.
None of these feel like security decisions in the moment. However, each creates a connection between personal digital activity and business systems and that connection sits outside most traditional security controls.
Hardening systems, deploying tools and locking down networks addresses part of the problem. The rest moves with the people.
How Personal Web Habits Create Business Exposure
Personal channels are phishing’s preferred territory.
Personal inboxes, messaging platforms and social media feeds are where phishing thrives.
These environments are harder to filter, easier to spoof and loaded with the emotional triggers that make people act before they think.
When those channels share a device or browser with business systems, a single click can cross the boundary instantly.
Phishing is the most common entry method for attackers precisely because it exploits distraction rather than technical weakness. The target does not need to be careless. They just need to be busy.
Password reuse turns personal breaches into work incidents.
Password reuse is one of the most direct connections between personal and professional exposure.
When credentials from a personal account are compromised, attackers run them against business systems automatically. This technique (credential stuffing) is low-effort and highly effective because so many people use the same password across multiple accounts.
Unique credentials for every account combined with multi-factor authentication breaks that chain.
A personal breach has nowhere to go when the work account requires a second factor that the attacker cannot relay.
Shadow IT is usually about convenience rather than defiance.
Most unauthorized tool usage does not begin with disregard for IT policy. It begins with a productivity gap. Employees use personal cloud storage, consumer messaging apps or AI tools because they are faster and more familiar than the approved alternative.
The security risk is not the intention behind the choice. It is what happens to the data.
Once business information moves into platforms that IT cannot see, audit or secure, it falls outside every control in place. The tool usage is predictable. The data exposure is not.
Why Blocking Behavior Doesn’t Work
The instinct is to lock things down. Block personal apps, restrict browsing and enforce strict device policies.
In practice, blanket restrictions rarely stop the behavior. They relocate it. Users find workarounds. Unapproved tools move to personal devices. IT teams lose visibility into exactly the activity they were trying to manage.
The risk does not disappear. It moves somewhere harder to see.
Security strategies that assume perfect compliance perform poorly in real workplaces. The goal is not eliminating the overlap between personal and professional digital activity. It is managing it without breaking how people work.
What Actually Reduces Risk
The controls that work are the ones that match how people actually operate.
Separate contexts rather than people.
The simplest way to reduce crossover risk is to reduce crossover.
Separate browser profiles for work and personal activity, clear guidance on where business accounts should be accessed and identity boundaries that prevent accidental mixing all reduce exposure without restricting what people do with their time.
This is not about surveillance. It is about creating enough distance between personal and professional digital activity that a compromise in one does not automatically reach the other.
Design for credential failure.
Assume passwords will eventually be exposed somewhere. Design for that outcome rather than hoping to prevent it.
CISA reports that enabling multi-factor authentication makes accounts 99% less likely to be compromised even when the underlying password has already been stolen.
MFA converts the most common attack path into a dead end.
Stolen credentials from a personal breach cannot reach a work account that requires a second factor. A password manager handles unique credentials across every account which makes that protection sustainable without placing an unrealistic burden on users.
Make secure behavior easier than unsafe behavior.
Personal web habits are not dangerous by default. Ignoring the risk they create is. The most secure environments today are not the most restrictive. They are the most realistic. They are built around how people actually work, designed to contain failure when it happens and focused on making safer behavior the path of least resistance.
Helping clients reduce human-driven security risk is one of the most impactful services an MSP can offer.
Contact us or schedule a consultation to review current controls and identify where the most important gaps are.
Article FAQs
Why do personal web habits increase cybersecurity risk?
These habits often happen outside secure and monitored environments and can expose credentials or data through phishing, password reuse or unapproved tools.
Is blocking personal internet use the best solution?
No. Blocking behavior often leads to workarounds and reduces visibility. Most security experts recommend guardrails, education and separation instead.
How can MSPs reduce risks without hurting productivity?
By enforcing MFA, separating work and personal contexts, providing clear guidance and offering ongoing security education tailored to real workflows.
Article Summary: Passwords remain a leading cause of breaches. However, most teams still rely on them for daily access. Passkey migration replaces passwords over time with device-bound and cryptographic credentials that can’t be phished, reused or stolen from a server. This shift reduces credential risk and helpdesk friction and most teams already have the core infrastructure needed to begin.
Your team locks everything down with passwords. Some are strong, some are not and most have been reused somewhere over the years. Every month, IT fields reset requests. Every year the same breach reports list stolen credentials as the leading cause.
There is now a more effective path and it does not require users to memorize anything.
Passkey migration is the process of moving from traditional passwords to passkeys which is a form of phishing-resistant authentication that uses your device's built-in security instead of a shared secret.
It is practical and it is already supported by most major platforms and the business case is hard to argue with.
Why Passwords Are Still the Biggest Risk
Passwords have had sixty years to prove themselves. The data tells a consistent story.
More than 80% of data breaches involve compromised credentials which is a figure that has remained consistent year after year according to the Verizon Data Breach Investigations Report.
The underlying problem has not changed. Passwords are shared secrets that must be stored somewhere and secrets that get stored eventually get stolen.
Multi-factor authentication (MFA) reduced that risk significantly and remains an important baseline. However, SMS-based codes (still the most common form of MFA) have a known weakness.
Modern phishing kits can intercept a one-time code in real time. A convincing fake login page captures both the password and the code and uses them on the real site before the session expires.
Phishing-resistant authentication closes that gap by design. Passkeys make it technically impossible for a fraudulent page to trigger login on your real device because the credential is cryptographically bound to the legitimate domain.
What a Passkey Actually Is
A passkey is a cryptographic credential. This means that instead of a shared password stored on a server your device creates a matched pair of digital keys when you register with a service.
The private key stays on your device and never leaves it. The public key goes to the service.
When you log in, your device uses biometrics (Face ID, a fingerprint or Windows Hello) or a device PIN to sign a cryptographic challenge from the server. The server verifies the signature using the public key. No password is ever transmitted.
A passkey cannot be phished because a fraudulent login page cannot trigger authentication on your real device. It cannot be reused because it is bound to a specific domain. It cannot be exposed in a server-side breach because the private key never exists outside your device.
Passkeys are built on the FIDO2 (Fast IDentity Online 2) and WebAuthn open standards (backed jointly by Apple, Google and Microsoft). The FIDO Alliance reported that more than 15 billion online accounts now support passkey sign-in which is double the figure from the year before.
What Passkey Migration Actually Means
Passkey migration is not a single cutover. It is a gradual transition that runs passwords and passkeys in parallel until passkeys are established across the accounts and platforms that matter.
A migration plan typically covers three things:
- Which platforms already support passkeys
- Which users to start with
- What fallback options exist for tools that are not yet ready
For most business teams running Microsoft 365 or Google Workspace, the infrastructure is already in place.
Microsoft enabled passkeys through Entra ID and made them the default sign-in for new accounts in May 2025. Google has supported passkeys for Workspace accounts since 2023. For teams in either ecosystem, passkey migration can begin without new infrastructure.
How to Approach Migration Without Disrupting Your Team
Start where support already exists.
Begin with administrators and power users. They reset passwords most often, have the highest-risk access and will give you honest feedback on friction before rollout reaches the wider team.
Map your current tools against passkey support before communicating any change.
Platforms like Microsoft 365, Google Workspace, GitHub, Shopify and most major identity providers already support passkeys fully. Start with those. Leave unsupported tools for a later phase.
Run passwords and passkeys in parallel.
The most common migration mistake is treating it as a full cutover.
Users can authenticate with passkeys on enrolled devices and fall back to a password on any device not yet enrolled. Running both methods simultaneously gives time for adoption without locking anyone out mid-project.
Plan for platforms that are not ready yet.
Not every tool supports passkeys today.
For those, a password manager generating unique credentials is the right bridge. It eliminates the password reuse risk now and when those platforms add passkey support, migration becomes a single enrollment step rather than a behavior change.
The Business Case Beyond Security
Security is the primary driver but the operational benefits are real and measurable.
Google reports that passkey sign-ins are four times more successful than password-based logins with sign-in speeds approximately 20% faster.
According to authentication research published by Google, the improvement comes from removing friction. Users no longer mistype passwords, wait for SMS codes or trigger account lockouts by trying an outdated credential.
Fewer failed logins means fewer helpdesk calls and fewer interruptions.
NIST's 2025 update to SP 800-63-4 now requires phishing-resistant authentication as a mandatory option for high-assurance access. This means passkey migration is also a compliance step for teams working toward those standards.
From Password-Dependent to Passwordless
Ready to start your passkey migration?
Contact us or schedule a consultation to map out which platforms in your environment support passkeys today and build a migration plan that works for your team.
Article FAQs
Do passkeys work across all devices and platforms?
Most modern devices support passkeys natively: iPhone, Android, Windows and Mac all include built-in passkey support through iCloud Keychain, Google Password Manager and Windows Hello. Chrome, Safari and Edge all support passkey sign-in. Not every app or service has added passkey support yet but major platforms including Microsoft 365, Google Workspace, GitHub and Apple ID are fully ready.
What happens if a user loses the device their passkey is stored on?
Passkeys sync across a user's enrolled devices through their cloud keychain. If a device is lost, the passkey is recoverable on any other device signed into the same account ecosystem. Recovery options are configured during enrollment and account recovery flows remain available as a fallback.
Article summary: Conference room device security requires the same attention as any other endpoint: updated firmware, strong credentials and proper network segmentation. Addressing these devices closes a surveillance gap that many businesses do not know they have.Read more
Article summary: When an employee leaves, their old computer often stays on the network forgotten but still connected and completely unmonitored. These ghost devices give attackers an easy entry point into your business because no one is checking them for updates, suspicious activity or lingering access credentials. A proper offboarding and device retirement process backed by ongoing network monitoring closes this gap before it becomes a costly breach. Read more