Closing the gaps in your Microsoft 365 security / live

You already pay for Microsoft security. Is anyone watching it?

Most UK organisations licence Defender, Entra and Purview through Microsoft 365. Few use all of it, and fewer still have anyone on the alerts at 2am. One hour on closing that gap with the tools you already own.

Wednesday 25 November

10:00 to 11:00 UK / online

--days

--hrs

--mins

Before you register

Four questions to ask before 25 November

If any of these takes longer than a minute to answer, the hour is for you.

01If Defender raised a high severity alert at 2am on Sunday, who would see it, and how fast?
02Which security features in your current Microsoft 365 licence are still switched off?
03How many third party tools are doing a job Microsoft already gives you?
04Could you show your insurer evidence of round the clock monitoring at your next renewal?

An alert nobody reads does the same job as no alert at all.

The gap this session is about

Why it matters now

Attacks arrive through the front door, at any hour.

65%

of medium sized UK businesses reported a breach or attack in the last 12 months. For large businesses it was 69%.

38%

of UK businesses were hit by phishing, by far the most common type of attack, and the one Microsoft 365 email and identity controls are built to stop.

97%

of identity attacks Microsoft sees are password attacks. MFA blocks over 99% of them, when it is on everywhere and someone acts on what gets through.

Sources: Cyber Security Breaches Survey 2025/2026, DSIT, published 30 April 2026. Microsoft Digital Defense Report 2025.

Microsoft is changing the ground under you

Six changes that alter what your team sees, and when

Two have already landed. None of them break loudly: alerts move, rules stop updating, consoles retire. We will cover what each one means for your monitoring.

Live since 12 OctoberDefender XDR records Purview DLP alerts as behaviours by defaultData loss signals leave the incident queue your team or provider watches.
Retired 3 NovemberThe memberOf rule for dynamic groupsGroups that drive Conditional Access and licensing stop updating. Leavers can keep access.
End DecemberSMTP AUTH basic authentication is switched off by default in Exchange OnlineScanners and older apps stop sending mail, or get switched back to password only sign in.
12 January 2027Windows Server 2016 reaches the end of extended supportAnother server generation without security updates. Migration needs approval before Christmas to land in time.
31 March 2027Microsoft Sentinel leaves the Azure portal for the Defender portalAnalytics rules, automation and SOC workflows have to move or monitoring breaks.
In previewThe integrated security operations centre (ISOC) in Microsoft DefenderSIEM and threat protection in one workspace, with agents working alongside analysts. Chorus Cyber's SOC is built to run on it.

Sources: Cybit Microsoft Newsletter, October 2026, and Microsoft. See the Microsoft Security blog on ISOC, 23 September 2026.

What the session covers

Make the most of what you already own

On Wednesday 25 November at 10:00, Mark Jones and Anthony Polson of Chorus Cyber join Jack Richardson of Cybit to look at the security tools in Microsoft 365, the threats they stop, and what a 24x7 monitoring, detection and response service built on Microsoft looks like in practice.

The attacks UK organisations face

The top attacks hitting UK organisations right now, and which Microsoft 365 tools are already there to stop them.

24x7 response built on Microsoft

What round the clock monitoring and response looks like when it runs inside Defender and Sentinel, from first alert to closure.

Lower cost, clearer compliance

How to remove third party costs and complexity, keep your data in your own tenant, and meet rising cyber regulation and insurer questions.

Practical next steps

What to switch on, what to review and where to start, so you leave with a plan for your own Microsoft 365 estate.

Bring your questions for the live Q and A at the end.

In partnership

About Chorus Cyber. Chorus Cyber runs a UK security operations centre built entirely on Microsoft. Its analysts monitor identity, email, endpoints, cloud apps and infrastructure around the clock using Microsoft Defender and Sentinel, the tools many organisations already licence through Microsoft 365. A Microsoft partner since 2004, Chorus is a member of the Microsoft Intelligent Security Association, holds two Microsoft Advanced Specialisations in security and is a Microsoft verified MXDR provider. Cybit partners with Chorus Cyber to give clients 24x7 detection and response inside their own Microsoft environment.

About Cybit. Newcastle headquartered Cybit helps organisations predict change, protect what matters, and perform with confidence. We deliver intelligent, secure, and connected solutions across data & AI, cybersecurity, cloud, and modern workspace, turning technology into a true strategic advantage.

Who you will hear from

The people who watch the alerts

Keynote / Chorus Cyber

Mark Jones

Head of Cyber Security, Chorus Cyber

Mark leads cyber security at Chorus Cyber, whose analysts watch customer environments 24x7 from its UK security operations centre. He spends his time where attacks actually happen: in Defender and Sentinel alerts, working out which ones matter and how fast they can be shut down.

Mark walks through the attacks UK organisations are seeing now and what a Microsoft built detection and response service does about them.

Speaker / Chorus Cyber

Anthony Polson

Partner Development Executive, Chorus Cyber

Anthony works with Chorus Cyber's partners to bring 24x7 Microsoft security operations to their customers. He sees the commercial side of security every day: overlapping third party tools, licences paid for and not used, and the questions insurers now ask before renewal.

Anthony covers how to consolidate on Microsoft, cut cost and show a clearer security posture.

Host / Cybit

Jack Richardson

Security Solutions Specialist, Cybit

Jack helps Cybit clients get more protection from the Microsoft security they already own. Before Cybit he worked at VIPRE Security Group, giving him a close view of how email and endpoint threats reach organisations and how they are stopped.

Jack brings the session back to practical next steps: what to switch on, what to review and where to start.

When you register

Three things you get, even if you cannot make it live

The recording and slides. Sent to every registrant after the session, so you can share them with your team or your board.
Your question answered. Send it in with your registration and Mark and Jack will take it first in the live Q and A.
A 30 minute Microsoft 365 security review. Offered to attendees who want it. Jack looks at what your licence includes, what is switched on and who is watching it. No obligation.

One hour

Leave with a clear view of what your Microsoft security can do, and who should be watching it.

Can't make it live? Register anyway. The recording goes to registrants only.

Wednesday 25 November, 10:00 to 11:00

Save your place

While you wait

Two things worth reading first

Both are source material for the session.

Cover of the Cybit Microsoft Newsletter, October 2026

Cybit newsletter / PDF

What to try, what to review and what to plan for

Our October Microsoft newsletter, 31 pages from Cybit Solutions Architect Peter McLeavery. It covers the DLP alert change in Defender XDR, the memberOf retirement, Entra and Conditional Access checks, and the October to January deadline calendar.

Download the newsletter Microsoft / external

Reimagining the SOC for the agentic era

Microsoft's announcement of the integrated security operations centre in Defender: SIEM and threat protection in one workspace, with agents working from the same context as analysts. It shows where Microsoft security operations are heading.

Read it on microsoft.com

Rather not wait

Want to talk now?

If you already know where your gap is, leave your details and Jack will come back to you directly.