Good Friday • Visibility • Microsoft Security

Agent Foskett’s Good Friday Cyber Briefing

Today feels like a good day to pause and reflect. Long weekend for us. Not for attackers. Most organisations already have the tools, but they still don’t have the visibility.

Discuss your environment Back to briefings

Briefing summary

The gap usually is not technology. It is understanding what the data is telling you, and knowing what to do with it before small issues become real exposure.

Azure deployed but not secured properly

Microsoft 365 in place but no real governance

Logs collected but never actually reviewed

What I see all the time

The tools are there. The visibility often is not.

Azure is present, but not truly protected Cloud services are often deployed and functioning, but security posture, access boundaries and recovery thinking have not kept pace with the rollout.

Microsoft 365 exists, but governance is weak Identity, data access and collaboration are in place, yet many environments still lack the guardrails, ownership and operational discipline needed to manage risk properly.

Logs are collected, but meaning is missed Organisations are pulling data into Defender, Sentinel and Entra ID, but too often nobody is stopping to ask what it means or what action should follow.

Inside the Microsoft security stack

These tools are powerful, but only when someone interprets what they are showing.

Defender detects behaviour Signals are there, but subtle activity still gets ignored when teams only focus on high-severity noise and never investigate the quieter patterns.

Sentinel connects signals Correlation is valuable, but it does not replace human judgement. Data becomes useful when someone joins the dots and sees what does not fit.

Entra ID enforces identity Authentication controls matter, but identity only becomes security when access decisions are governed, monitored and reviewed in the real world.

The real gap

Security is not just configuration. It is interpretation.

Ask what the data actually means Most environments do not fail because they lack tooling. They fail because nobody is asking the right questions of the telemetry they already have.

Decide what should happen next The value is not just finding events. It is knowing whether to investigate, harden, block, tune, escalate or redesign the control entirely.

Real-world insight is the difference That is where many organisations fall down: not because they lack tools, but because they lack operational understanding of what those tools are trying to tell them.

Agent Foskett’s Good Friday Cyber Briefing

Briefing summary

What I see all the time

Inside the Microsoft security stack

The real gap

Agent Foskett Good Friday Cyber Briefing