For many financial services firms, the most likely serious incident isn't ransomware. It's a compromised mailbox followed by a diverted payment. Business email compromise (BEC) is cheap for attackers, hard to spot, and causes direct client harm. It almost always starts in Microsoft 365.
How the attack usually runs
- A user's credentials are phished, often through an adversary-in-the-middle page that also captures the MFA session.
- The attacker signs in, reads mail for days or weeks, and learns who pays whom and how.
- They create inbox rules that hide replies from the real client or supplier.
- At the right moment, a "change of bank details" email goes out from a genuine mailbox.
None of this needs malware, and very little of it shows up in a traditional external pen test.
What a tenant security test should cover
Identity and access
- MFA coverage, including service accounts, break-glass accounts and shared mailboxes;
- legacy authentication protocols that bypass MFA;
- conditional access gaps: unmanaged devices, risky locations, exclusions that grew over time;
- whether phishing-resistant MFA is used for privileged and finance roles;
- session lifetimes and token protection.
Mail flow and spoofing
- SPF, DKIM and DMARC configuration, and whether DMARC is actually set to reject;
- whether users can create external forwarding rules;
- lookalike domain exposure;
- external sender warnings and impersonation protection.
Applications and consent
- whether users can consent to third-party apps (illicit consent grants);
- over-privileged app registrations and stale secrets;
- who holds Global Administrator and other privileged roles, and whether access is just-in-time.
Detection and response
- whether audit logging is enabled and retained;
- whether alerts fire for new inbox rules, impossible travel and suspicious consent;
- how quickly a compromised session can be revoked in practice.
Go beyond configuration review
A configuration review tells you what's set. An assumed-breach test tells you what an attacker can actually do. Starting from a standard user account, the tester attempts to set hidden rules, reach finance mailboxes, access SharePoint client folders and escalate privileges, while your team sees whether anything alerts. That's the evidence that matters for operational resilience and for your insurer.
Process controls still matter
Technical controls reduce the risk, but the final defence against payment diversion is a process control: independent call-back verification of any bank detail change, enforced in the system rather than just written in policy. Test that too.
FAQs
Is Microsoft 365 included in a penetration test?
Not usually by default. Tenant security reviews and assumed-breach testing of Microsoft 365 should be scoped explicitly, as they cover risks a network or web application test won't find.
Talk to SMARTSEC
Want your tenant tested the way attackers use it?
Fixed-price testing, scoped and delivered by a senior tester, with live findings on the SMARTSEC client platform.
Talk to us →