Author
Kunaal Sharma
Don’t Get Spooked: 5 Habits That Prove You’re Actually Covered
Three weeks of finding things lurking in the tenant, and here’s the good news: most of it is fixed by boring, repeatable habits, and the rest just needs someone willing to prove it’s actually handled.
This is the last room in the house, and the last stop before the month’s recap.
1. Check Who’s Allowed Through the Door
A two-minute habit: review your external guest access settings today. Not a project. Not a quarterly initiative. Just two minutes, right now.
Over time, guest users accumulate through projects, vendor engagements, and collaboration requests. The question isn’t whether guest access exists. It’s whether the right people still have it.
What to do: Review your guest accounts and remove any users who no longer need access.
2. Your Password Has Seen Better Decades
If your password is old enough to vote, it’s time for a change.
Weak or reused passwords remain one of the easiest ways into an environment. Multi-factor authentication is still one of the most effective controls for stopping an attack, even when a password is exposed.
The real question this week: Is MFA actually enforced for everyone, or is it simply encouraged?
What to do: Confirm MFA is enforced for everyone and review any accounts that are still exempt.
3. Patch It Before It Bites
Every unpatched device is an open door with a sign on it. Software updates close known vulnerabilities that attackers are actively scanning for. The fix already exists. It just needs to reach the device.
What to do: Check your patch compliance report this week and follow up on devices that have fallen behind.
Reminder: A vulnerability is only fixed once the update is installed, not when it’s released.
4. Who Holds the Keys Now?
When was the last time someone reviewed your governance setup? More importantly, who specifically did it?
If you can’t name a person and a date, that’s the finding. Not a misconfiguration. Not a missing setting. The absence of anyone owning the question.
What to do: Name a governance owner this week and put a review date on the calendar.
5.Know Your Security Score
If someone asked how secure your Microsoft 365 environment is today, would you know the answer?
Microsoft provides visibility into your security posture through Secure Score, helping identify gaps across identity, devices, applications, and data protection.
While no score tells the whole story, it can quickly highlight areas that need attention before they become bigger problems.
What to do: Review your Secure Score and identify your next three improvement opportunities.
Where Should You Start?
If you only tackle one thing this week, don’t try to fix everything. Pick one of the five habits above and verify that it’s actually happening today. Review who has guest access. Confirm MFA is enforced. Check patch compliance. Assign a governance owner. Review your Microsoft Secure Score and identify where you need improvements. Any one of these actions will tell you more about your security posture than another month of assumptions.
The goal isn’t to find every gap at once. It’s to replace uncertainty with evidence and build habits that keep small problems from becoming larger ones. The organizations that stay secure aren’t necessarily doing extraordinary things. They’re consistently doing the basics and validating that those controls are working.
