Insights

27/1/2025

Microsoft has updated the Exchange Online SMTP AUTH Basic Authentication deprecation timeline. After delays to support customers still transitioning, Microsoft now plans to fully retire Basic Auth for Client Submission in stages, and organisations still relying on it need to move to Modern Authentication or alternative options to avoid mail flow disruption. The post is mainly a reminder for admins to confirm where SMTP AUTH Basic Auth is still in use and complete remediation before the new cutoff dates.

15/1/2026

Researchers disclosed WhisperPair, a critical flaw in Google’s Fast Pair protocol that can let attackers silently take over vulnerable Bluetooth audio devices. In some cases they can pair without the user knowing, track the device’s location, or even eavesdrop through its microphone. The issue affects many Fast Pair-enabled earbuds, headphones, and speakers across multiple brands, and the main fix is to apply any available firmware updates from the manufacturer.

23/12/2025

Microsoft is turning on stronger Teams messaging protections by default from 12 January 2026 for tenants still using the default settings and who have not already customised them. The change enables three protections: blocking potentially dangerous file types, warning on suspicious URLs, and letting users report false positives. Existing customised settings will stay as they are. Microsoft is also advising admins to review their Teams messaging safety settings, update internal documentation, and brief helpdesk staff before the rollout.

11/12/2025

The UK ICO fined LastPass £1.2 million over its 2022 breach, which affected data linked to 1.6 million UK users. The regulator said weak internal security controls allowed attackers to access customer information and encrypted password vault backups, highlighting the need for stronger internal protections even for security-focused providers.

25/11/2025

The threat actor known as ToddyCat has been observed adopting new methods to obtain access to corporate email data belonging to target companies, including using a custom tool dubbed TCSectorCopy. "This attack allows them to obtain tokens for the OAuth 2.0 authorization protocol using the user's browser, which can be used outside the perimeter of the compromised infrastructure to access corporate mail," Kaspersky said in a technical breakdown.

19/11/2025

Microsoft is trying to transform Windows into a “canvas for AI,” with new AI agents integrated into the Windows 11 taskbar. These new taskbar capabilities are designed to make AI agents feel like an assistant in Windows that can go off and control your PC and do tasks for you at the click of a button. It’s part of a broader overhaul of Windows to turn the operating system into an “agentic OS.”

18/11/2025

The rise of the Tycoon 2FA phishing kit should serve as a global warning siren for every enterprise. This is not a tool for elite hackers. This is a turnkey kit that anyone with a browser can use to bypass the very MFA and auth apps companies depend on. And it is being used at scale. Over 64,000 attacks have already been tracked this year, many targeting Microsoft 365 and Gmail because those platforms represent the easiest, fastest path into an enterprise.

30/10/2025

There has been a tremendous amount of conversation lately about artificial intelligence and what it means for cybersecurity. Depending on who you talk to, AI is either going to replace every job in the security industry or it is going to fade into the background as just another tool in an already overloaded technology stack. The truth, as usual, lives somewhere in between those extremes.

24/10/2025

Microsoft is currently working on a new Teams feature that will use Wi-Fi network connections to pinpoint a user's exact location. For context, Teams will automatically update a user's work location when they connect their device to an office Wi-Fi network.