Phishing has been and continues to be one of the most common methods (TTPs) cyber attackers use because it is so effective. Phishing is a simple attack vector that enables cyber attackers to easily scale their attacks, customize for their intended targets, and bypass many security controls. Reports like the Verizon DBIR or the Microsoft Digital Defense continue to identify phishing as a top risk. While technologies like email filtering (example Proofpoint) and EDR (example Crowdstrike) make it much more difficult to succeed, cyber attackers have continued to adapt.

Threat hunting is proactively identifying and thwarting unusual network activity that could indicate an attempted security breach. It’s a historically manual activity, making it time-intensive and arduous. It’s no wonder, then, why most organizations don’t have the time, budget, or resources to undertake it effectively…if at all. That’s why many organizations rely on “reactive” threat response solutions, including firewalls, intrusion detection, and SIEM to alert analysts to an event after it occurs. Without the resources to commit to proactive threat hunting, reactive solutions are the next best option.

Tenant-to-tenant migrations are increasingly common. Some are necessitated by business changes like mergers, acquisitions, and divestitures, while others are driven by the desire to clean up or consolidate the IT infrastructure to facilitate business processes and reduce administrative overhead.