MICROSOFT 365 SECURITY
We monitor your Microsoft 365 environment around the clock for signs of compromise, implement security baselines that reduce your risk, and report on your security posture every month. Protection that works in the background so your team does not have to think about it.
Most breaches are not loud. They start with a compromised account, a forwarding rule, or an unexpected login from overseas. Without active monitoring, these signals go unnoticed for months.
The average self-reported cost of cybercrime per report for Australian small businesses has risen 45% in four years, from $39,000 to $56,600. These figures only capture reported incidents. The real cost, including business disruption, legal exposure, and customer trust, is typically much higher. For context, the IBM Cost of a Data Breach Report puts the average Australian breach at $4.26 million when all costs are included.
Email compromise is the number one cybercrime type for Australian businesses, making up 34% of all reports when you combine direct compromise and BEC fraud. This is exactly why the GCIT Security Pack focuses heavily on email monitoring: forwarding rules, impersonation attempts, and sign-in anomalies. These are not theoretical threats. They are the most common entry points attackers use right now.
Source: ASD Cyber Threat Report 2024-25
Attackers follow patterns. Once they compromise an account, they typically set up persistence, exfiltrate data, and escalate privileges. We watch for each of these behaviours in real time.
Every sign-in is tracked by location. We alert on activities outside expected countries so you know immediately if someone accesses an account from an unusual location. Most compromised accounts show overseas logins before any damage is done.
We flag external emails that attempt to impersonate internal users. These are among the most effective attack techniques because they exploit trust. A message from someone who looks like your CEO or accountant can trick even cautious staff.
One of the first things attackers do after compromising a mailbox is create a forwarding rule to silently copy emails to an external address. We monitor for new forwarding rules across all mailboxes and alert immediately when one appears.
Privilege escalation is a key attacker objective. If an account is elevated to Global Admin or Exchange Admin, we report it immediately. Unauthorized role changes can give attackers full control of your Microsoft 365 tenant within minutes.
Monitoring catches threats. Security baselines prevent them. We configure your Microsoft 365 environment with the settings and policies that reduce your attack surface from day one.
Security is not a product you install. It is a process that starts with understanding your environment and builds from there. Here is how we roll out the Security Pack for new clients.
We run a full audit of your Microsoft 365 tenant: current Secure Score, MFA adoption, mailbox configurations, admin roles, and existing policies. This gives us a clear picture of where you stand and what needs attention first.
We configure the settings that reduce your risk immediately: MFA for all users, audit logging across services, anti-phishing policies, and mailbox backup. These are not optional extras. They are the minimum standard for any business running Microsoft 365.
With baselines in place, we activate our monitoring tools. Login locations, forwarding rules, impersonation attempts, admin role changes, and suspicious sign-in patterns are all tracked and alerted on automatically.
When someone leaves, their access needs to be revoked immediately. Our offboarding process backs up their mailbox, disables company access, sets up mail forwarding, and removes licences in seconds, not days.
Each month, you get a clear report on your security standing: what happened, what changed, and what we recommend next. Security is not set-and-forget. Your environment, your team, and the threat landscape all evolve.
If monitoring detects a genuine threat, we act immediately. Compromised accounts are locked, sessions are revoked, and forensic investigation begins. You will know what happened, how it happened, and what we did about it.
The Security Pack works with any Microsoft 365 or Office 365 licence, but the full value comes with Microsoft 365 Business Premium. Premium includes Defender for Office 365, Intune device management, and conditional access, which give us significantly more visibility and control.
If you are still on Microsoft 365 Business Basic or Business Standard, upgrading to Business Premium is one of the highest-impact security improvements you can make. It is not just about features. It is about the security data those features generate, which powers everything we monitor.
We can help you assess whether an upgrade makes sense for your business and handle the migration if it does.
| Capability | Microsoft 365 Business Basic or Standard | M365 Business Premium |
|---|---|---|
| Multi-factor authentication | Basic | Advanced (Conditional Access) |
| Anti-phishing protection | Standard | Defender for Office 365 |
| Device management | None | Intune MDM/MAM |
| Sign-in risk detection | None | Microsoft Entra ID P1 risk policies |
| Data loss prevention | Limited | Full DLP policies |
| Threat investigation | None | Threat Explorer |
Australian businesses face real obligations when it comes to protecting personal information. These regulations are not theoretical. They carry significant penalties and reputational consequences.
If your business suffers a breach involving personal information that is likely to cause serious harm, you must notify affected individuals and the OAIC. In 2024, a record 1,113 breaches were reported. Failure to comply can result in penalties of up to $50 million for serious or repeated breaches under the updated Privacy Act.
The Australian Signals Directorate’s Essential Eight mitigation strategies are the baseline standard for cyber security in Australia. Several controls in the Security Pack directly align with Essential Eight requirements, including MFA, application control awareness, and audit logging. Increasingly, cyber insurers and government contracts reference Essential Eight compliance.
GCIT is ISO 27001 certified. The controls we implement through the Security Pack are informed by the same information security management framework we use internally. For clients pursuing their own certification or needing to demonstrate security controls to partners and insurers, our approach provides documented evidence of your security posture.
Cyber insurance providers are increasingly requiring evidence of specific controls before issuing policies: MFA on all accounts, email backup, audit logging, and incident response plans. The Security Pack covers these requirements directly, which can simplify your renewal process and potentially reduce your premiums.
The Security Pack is our standard set of security monitoring tools and configuration baselines for businesses running Microsoft 365. It includes real-time monitoring for suspicious activity (login locations, forwarding rules, impersonation, admin changes), security baselines (MFA, audit logging, anti-phishing policies), cloud email backup, and monthly security reporting. It is designed to provide meaningful protection without adding complexity for your team.
No. The Security Pack works with any Microsoft 365 or Office 365 licence. However, Microsoft 365 Business Premium provides significantly more security capabilities, including Defender for Office 365, conditional access, and Intune device management. These features give us deeper visibility and stronger controls. We will assess your current licences and recommend an upgrade only if it makes sense for your situation.
Every Microsoft 365 sign-in includes location data based on the IP address used. We track these locations and alert when a sign-in occurs from an unexpected country. This catches common attack patterns where stolen credentials are used from overseas before the account owner notices anything unusual. It does not track GPS or device location, only the geographic origin of the sign-in request.
We respond immediately. For a compromised account, we revoke active sessions, reset credentials, check for persistence mechanisms like forwarding rules, and investigate what data may have been accessed. You will receive a clear summary of what happened, what we did, and any recommended follow-up actions. For clients on our managed services plans, this incident response is included.
All mailboxes are backed up to an independent, third-party cloud service that is completely separate from your Microsoft 365 tenant. This means if your Microsoft environment is compromised by ransomware or an accidental deletion, your email backup remains safe. We can restore individual emails, folders, or entire mailboxes to any point in time covered by the backup retention period.
Each report covers your Microsoft Secure Score and how it compares to the previous month, a summary of sign-in locations and any anomalies, forwarding rule and admin role change activity, guest and external user access review, and prioritised recommendations for improvement. The goal is to give you a clear, honest view of where your security stands and what to focus on next.
The Security Pack is included as part of our managed services plans. It is most effective when combined with ongoing IT management because security monitoring without the ability to act on alerts creates a gap. If you are interested in the Security Pack, talk to us about our Security First Managed Services to understand how it fits into a complete support arrangement.
For most businesses, the initial audit and baseline implementation takes 1-2 weeks. The exact timeline depends on the size of your Microsoft 365 environment, how many users you have, and how much configuration is already in place. Monitoring starts immediately after baselines are configured. The first monthly report is typically delivered within 30 days of setup.
Talk to our team about a security audit of your Microsoft 365 environment. We will review your current configuration, identify gaps, and show you exactly what the Security Pack would look like for your business.
