Cyber attacks are now cheap, industrialized, and aimed at everyone, so security cannot be a one-off project or the IT team’s problem alone. That was the message from Emil Monroe, senior engineering lead at Silicon Overdrive, at a recent DVT Insight session. He walked through how the threat landscape has changed, why zero trust is the right response, and where Microsoft’s new Security Copilot fits in. Here are the highlights.
Hacking is now a service you can buy
You no longer need to be a skilled hacker to launch an attack. Compromised accounts, denial-of-service attacks, and ransomware are all sold on the dark web, and Emil put the price of a ransomware attack at around $66. Anyone with a grudge, such as a former employee or an unhappy customer, can hire an expert.
Ransomware itself has grown from a nuisance into human-operated extortion. Some operations run like call centers, with hundreds of people phoning vulnerable targets to get control of their machines. Attackers rent private data centers to run their campaigns, which is why your Entra ID sign-in logs may show attempts from the US, Russia, and Argentina even when none of your staff travel.
It pays because victims often have no choice. Many organizations have no disaster recovery plan, or keep backups that don’t follow the local, offsite, and cloud pattern, so the backups get encrypted too. A hospital that can’t reach patient data will pay. Every payment proves the model works, so the attacks continue.
Why MFA alone will not save you
Turning on multi-factor authentication and calling it done is no longer enough. Attackers haven’t broken MFA; they’ve found ways around it. The most common one Emil sees is session-token theft through phishing.
It works like this. You accidentally click a phishing link in a browser where you ticked “keep me signed in”. The page steals your session cookie, a small file on your computer. The attacker loads that cookie into their own browser and walks into your account without ever needing your password or your phone.
The fix in Microsoft 365 is session control through conditional access. If a session token created on your laptop suddenly shows up on a different device, the policy rejects it and asks for the password and MFA again.
For suspicious emails, Emil recommended a few layers:
- Safe Links in Defender for Office (formerly ATP Safe Links) has Microsoft check a link before you land on the site. Better still, configure it to check links before the email is delivered at all.
- Hover before you click. The address shown at the bottom of the window should match where the link claims to go.
- Report Phishing in Outlook is available without premium licenses. Microsoft investigates the message and tells you whether it’s safe, and admins can find and remove the same email from every other mailbox.
- User awareness training, such as Microsoft’s phishing simulations or KnowBe4, keeps the habit fresh.
When in doubt, send it to your IT admin for a second look.
Security is everyone’s job
Security works best when it’s driven from the top. A sponsor, often the CEO, hands the mandate to a project lead and the CISO, who find the gaps and get controls in place. An IT admin who quietly switches on a pile of restrictions will mostly just annoy people.
That shared ownership matters more as specialists get scarcer. Emil pointed to IBM’s data breach report, which found a 26% drop in skilled cybersecurity staff over the past year. That gap is exactly what tools like Security Copilot aim to fill.
The same habits apply at home. If you use one password for work and for your banking, change that today.
Zero trust is about access, not distrust of people
Zero trust often lands badly because it sounds like “we don’t trust you”. Emil admitted he had the same reaction at first. The real point is that a staff member’s machine can be compromised without anyone knowing, and whatever that machine can reach, the attacker can reach too. In his words, zero trust means not blindly trusting access requests, wherever they come from.
It rests on three principles:
- Verify explicitly. Nothing bypasses checks, and every access is logged.
- Use least privilege. You can always grant more access later, but you can’t take it back after a breach. This applies to IT too: someone who creates user accounts needs User Admin, not Global Admin.
- Assume breach. If a user says their account is acting oddly, don’t put it down to an update. Investigate.
Emil also took apart a few false assumptions. Security doesn’t have to kill productivity: if you remove local admin rights, pre-approve common apps, and set up quick approval flows for the rest. IT admins aren’t safe either; his own account was breached about six years ago. And breaches are a matter of when, not if.
Explaining the risk first makes all of this easier to accept. People who understand what’s out there see the controls as protection for them, not suspicion of them.
Your AI tools are a new way for data to leak
Everyone wants AI, and staff will happily paste a sensitive document into a free public chatbot. On free tiers, you typically agree to let the provider use what you share, so your intellectual property has left the building. And if that personal account is ever compromised, the attacker gets every chat and upload with it.
The zero-trust answer is to block public AI tools at work and offer a managed option, such as Microsoft 365 Copilot, instead. Licenses are not free, so weigh each one against the time it will save.
Before rolling out Copilot, Emil recommended Microsoft’s AI readiness assessment. A big part of it is a data audit in Microsoft Purview, using sensitivity labels to make sure people can only reach what they should. Skip this, and Copilot will cheerfully surface whatever a user technically has access to.
The host offered a simple test: ask Copilot for everyone’s salaries. If anyone outside HR gets an answer, you have work to do.
Where zero trust lives in the Microsoft stack
Zero trust covers identity, devices, applications, data, infrastructure, and networking, and Microsoft has a tool for each area:
| Area | Microsoft tools | What they do |
|---|---|---|
| Identity | Entra ID, conditional access | Verify users and devices, and enforce access policies based on risk, location and device compliance |
| Devices and infrastructure | Intune, Azure | Manage laptops, phones, servers, and IoT devices, and block devices that aren’t compliant |
| Security operations | Microsoft Defender, Microsoft Sentinel | Endpoint and email protection, plus a modern SIEM with managed detection and response |
| Data | Microsoft Purview | Data loss prevention, insider risk and compliance across Microsoft 365, and in Azure across sources like SQL and AWS |
One of Emil’s most practical points: many businesses already pay for Microsoft 365 Business Premium but have never switched on Defender. That license includes Defender for Office, Defender for Endpoint (so you may not need third-party antivirus), and Intune. Protect on-premises systems too, because a breach there will spread to the cloud.
To start the journey, Emil outlined four stages:
- Identify your risks. Find your riskiest endpoints, in the cloud and on physical devices.
- Develop a response. Decide who is responsible for what.
- Visualize and document your posture, then implement.
- Never stop. Keep educating users, managing risk, and growing your security operations within budget.
The effort also moves you toward standards such as NIST, CIS, and ISO 27001:2022.
Security Copilot: an assistant, not an autopilot
Microsoft Security Copilot is an AI assistant that works across Defender, Entra ID, Sentinel, and Purview. Emil stressed the word assistant: it helps you investigate and fix problems, but it doesn’t solve them for you.
| It can | It can’t |
|---|---|
| Summarise incidents and explain the intimidating attack diagrams in the Defender portal | Take action automatically |
| Generate reports on how serious an incident is and how to fix and prevent it | Replace your IT team, Defender, or endpoint and cloud protection |
| Write threat-hunting (KQL) queries for you, which you can then turn into alerts | Ingest signals from non-Microsoft tools |
| Suggest improvements, such as to your conditional access policies | Replace Sentinel or another SIEM, or reach systems it hasn’t been given access to |
It’s also a training tool. Someone in IT who uses it learns as they go, and won’t need to ask the same question twice. For organizations that can’t afford a dedicated security specialist, that matters.
In the live demo, Emil asked it to show every user who had signed in from a new location in the past seven days. That normally means exporting and sifting through Entra ID reports by hand; Copilot pulled the data and answered in moments. It also wrote a query to hunt for open RDP ports, and suggested credential-access improvements.
Setup takes about 15 minutes, but you need an Azure subscription and must assign compute capacity. On the minimum of one unit, Emil hit the limit after three queries in five minutes and had to wait half an hour. Size it to how much you’ll actually use it.
Where to start
The session closed with four takeaways. Take the risk seriously, even if you think you’re already covered. Educate everyone, from reception to the CEO, because each person is part of the defense. Start your zero-trust journey with small, concrete steps. And use tools like Security Copilot to move from reacting to incidents to getting ahead of them.
As Emil put it, security is an ongoing battle: every time we close a gap, attackers look for another. The aim isn’t panic. It’s being prepared.