Client Initiative · 2026
Microsoft 365 Security & AI Readiness Initiative
We're tightening security, closing configuration gaps, and making sure your Microsoft 365 environment is ready for what's next — including AI tools like Microsoft Copilot.
Microsoft has made significant investments in security and AI capabilities over the last two years. Many of these protections may already be available within your existing Microsoft 365 licensing — they simply need to be properly configured. This initiative ensures your firm is getting the most from its current investment, while preparing your environment for safe AI adoption down the road.
What we're doing
Baseline AssessmentWe run a complimentary Microsoft 365 Security & AI Readiness Assessment on your tenant. This measures your current security posture, identifies configuration gaps, and evaluates how ready your environment is for tools like Microsoft Copilot.
Review & RecommendationsWe review the findings, identify the priority improvements, and provide you with the recommended remediation plan. Any changes that require additional licensing, cost, or business decisions are presented for your approval.
Security ImprovementsWe implement the approved changes: conditional access policies, permission tightening, data loss prevention rules, and other configuration hardening across your Microsoft 365 environment.
Email Security UpgradeWe're migrating all managed clients from MailProtector to Check Point Avanan — a modern email security platform that integrates directly with Microsoft 365 and catches threats that legacy gateway filters miss, including phishing, business email compromise, and account takeover attempts.
Final AssessmentOnce everything is in place, we run the assessment again. You'll see the before and after side by side — measurable proof of what improved.
What does “AI Readiness” mean?
We're not turning on AI tools in your environment. We're making sure your environment is configured correctly so that when you decide to explore tools like Microsoft Copilot, the permissions, data access, and governance are already in place.
Here's why that matters now: most Microsoft 365 tenants have overshared folders, loose permissions, and broad access rights that nobody notices day-to-day. But if you deploy an AI tool like Copilot, it inherits those permissions — which means it could surface documents, emails, and data that individual users shouldn't have access to. We fix that before it becomes a problem.
Even if you never adopt Copilot, tightening permissions and closing access gaps is good security hygiene that stands on its own.
A note on licensing: If you ever decide to turn on Microsoft Copilot, additional Microsoft 365 licensing and security capabilities may be recommended to ensure your environment is properly prepared. Many of the security improvements included in this initiative are already available within your current licensing. If we identify any recommended licensing changes during the assessment, we'll provide the options and associated costs for your approval before making any changes.
Why switch email security?
The email threat landscape has changed significantly in the last 18 months. Attackers are now using AI-generated phishing emails that contain no malicious links or attachments — they're pure social engineering, written in perfect English, referencing real projects and real people at your firm. Traditional gateway filters like MailProtector were designed to catch known threats: blacklisted senders, suspicious attachments, and URLs that match threat databases. They're not built for what's coming through now.
What's bypassing legacy email filters
AI-generated phishing
Attackers use AI to write convincing, personalized emails that contain no detectable payload. There's no malicious link to flag, no attachment to scan — just a well-crafted message that tricks someone into wiring money, sharing credentials, or changing payment instructions. Gateway filters pass these through because there's nothing technically “malicious” to detect.
Business Email Compromise (BEC)
An attacker compromises a vendor's email account — not yours, theirs — and sends legitimate-looking invoices or payment change requests from a real email address. Gateway filters see a trusted sender and let it through. This is the #1 financial loss category in cybercrime, and it's growing every quarter.
Account takeover
When an attacker compromises an account inside your Microsoft 365 tenant, the malicious emails they send never pass through a gateway filter at all. They originate inside your environment and go directly to other employees' inboxes. Gateway-based tools are completely blind to this.
QR code and image-based attacks
Attackers embed malicious URLs inside QR codes and images rather than in clickable links. Legacy filters scan text and URLs — they don't analyze images. The recipient scans the QR code on their phone, bypassing every layer of email security.
Check Point Avanan takes a fundamentally different approach. Instead of sitting outside your email flow, it connects directly to Microsoft 365 via API — analyzing email after Microsoft's built-in filters and before it reaches the inbox. It monitors internal email from compromised accounts, uses behavioral analysis to catch social engineering with no malicious payload, detects account takeover through login anomalies and inbox rule changes, and scans images and QR codes for hidden threats. Gateway filters can't do any of this because they never see inside your environment.
Think of it this way: a gateway filter is a lock on the front door. Avanan is a security system inside the building — it knows who belongs there, what normal looks like, and what doesn't.
Common questions
Do we have to switch email security?
No, but we highly recommend it. Email threats have changed significantly, and Avanan provides protections and visibility that our current MailProtector platform does not. We're moving toward Avanan as our recommended email security standard because we believe it provides a meaningfully stronger level of protection. If you prefer to remain on MailProtector, we can discuss that option with you.
Is there downtime during the email migration?
No. Avanan integrates with Microsoft 365 via API, so there's no MX record change and no mail flow interruption. Your team won't notice the switch — they'll just start seeing fewer threats reach their inbox.
What does our team need to do?
Very little. We handle the assessment, implementation, and migration. We may need a brief admin coordination call and temporary admin access if we don't already have it. We'll schedule everything around your team's workflow.
Are you deploying Copilot or other AI tools?
No. This initiative prepares your environment so AI tools could be deployed safely in the future, but nothing is turned on without a separate conversation and your explicit approval. The security improvements we're making are valuable regardless of whether you ever use AI.
We're not interested in AI. Is this still relevant?
Absolutely. Remove the AI component entirely and this initiative still delivers: tightened permissions, closed configuration gaps, stronger email security, and a measurable improvement in your Microsoft 365 security posture. The AI readiness piece is a bonus — the security work stands on its own.
What's included in the assessment?
The assessment evaluates your Microsoft 365 tenant across three dimensions: Security Configuration (MFA, conditional access, legacy authentication, data loss prevention), Exposure (external sharing, auto-forwarding, admin accounts, permission sprawl), and Copilot Readiness (licensing, data governance, permission structure). You'll receive a scored report with specific findings and recommendations.
Is there a cost for the assessment?
The assessment is included as part of our managed services relationship — no separate charge. The only cost change is the email security upgrade, which your account email details specifically for your firm.
What's the timeline?
We're rolling this out across all managed clients over the coming months. Once you approve, we'll schedule the baseline assessment within 1–2 weeks, implement improvements over the following 2–4 weeks depending on scope, and run the final assessment after everything is in place. Total timeline is typically 4–6 weeks from approval.
