One of the most common questions I hear from businesses is:
“Doesn’t Microsoft 365 already include security?”
The answer is yes.
Microsoft has built a number of security features into the platform over the years, including spam filtering, phishing detection and malware scanning.
For many organisations, these protections provide a solid baseline.
But the reality is that cyber attackers are constantly adapting. As email attacks become more sophisticated, many organisations are beginning to ask whether the default protections are enough on their own.
What Microsoft 365 already includes
Microsoft 365 includes several built-in protections designed to reduce common email threats.
These typically include:
spam filtering
malware scanning for attachments
basic phishing detection
safe link and safe attachment capabilities (depending on licensing)
These tools help block large volumes of automated spam and known malicious emails.
For many organisations, this provides an important first layer of defence.
But attackers are increasingly focusing on techniques designed to bypass traditional filtering.
How email attacks have changed
Years ago, many cyber attacks relied on obvious malware attachments or poorly written phishing emails.
Those attacks were relatively easy for email filters to detect.
Modern attacks look very different.
Today’s phishing emails often:
use convincing branding and language
imitate trusted contacts or suppliers
link to realistic login pages
target specific employees or departments
Some attacks involve business email compromise, where criminals impersonate a colleague or executive to request urgent payments or sensitive information.
Others rely on credential theft, tricking staff into entering their Microsoft 365 login details on a fake sign-in page.
Because these emails often contain no malware and look like legitimate communication, they can be harder for traditional filtering to detect.
Gaps attackers often exploit
Most successful email attacks today rely on subtle techniques rather than obvious malware.
Common examples include:
Credential phishing
Attackers send emails linking to fake Microsoft 365 login pages designed to capture usernames and passwords.
Once credentials are stolen, attackers can attempt to access the mailbox or launch further phishing attacks from the compromised account.
Impersonation attacks
These emails appear to come from someone the recipient trusts — such as a colleague, supplier or executive.
The message may ask for payment details to be updated or request urgent financial transfers.
Because the sender appears legitimate, these attacks can be particularly convincing.
Malicious links
Instead of attaching malware directly, attackers often send links to external websites that host phishing pages or malware downloads.
Some of these websites only become malicious after the email has already been delivered.
Why many organisations add a second layer
Because of these evolving attack techniques, many organisations are choosing to add a second layer of email protection alongside Microsoft 365.
This doesn’t replace Microsoft’s security.
Instead, it strengthens it.
Additional protection can help detect threats such as:
advanced phishing attacks
impersonation attempts
malicious links that appear after delivery
suspicious email patterns associated with business email compromise
This layered approach is becoming increasingly common, particularly for organisations handling sensitive information or financial transactions.
Protecting email and collaboration platforms
Another change in recent years is that communication has expanded beyond email.
Many organisations now rely on collaboration tools such as:
Microsoft Teams
SharePoint
OneDrive
These platforms can also be used to distribute malicious files or phishing links.
Modern cloud security platforms such as Check Point Harmony Email & Collaboration are designed to help protect both email and collaboration platforms by scanning messages, links and shared files for potential threats.
This helps reduce the risk of attacks spreading through internal communication channels.
A layered approach to email security
Cyber security rarely relies on a single tool.
Most organisations protect their systems using multiple layers of defence.
For email security this may include:
Microsoft 365 built-in protection
advanced phishing detection
link protection and attachment analysis
security awareness training for staff
monitoring for suspicious activity
Together, these layers help reduce the likelihood of phishing, account compromise or financial fraud.
Final Thought
Microsoft 365 includes valuable security protections.
But as email attacks continue to evolve, many organisations are choosing to strengthen those protections with additional layers designed to detect modern phishing and impersonation techniques.
Because when it comes to email security, relying on a single layer is rarely enough.
If you would like to review the security of your Microsoft 365 environment, Black Swan Cyber Security Solutions can help.
We support organisations across Derbyshire and South Yorkshire with modern email protection, identity security and 24/7 cyber threat monitoring.
