It is Bonfire Night, so here is the part of the story that usually gets left out. The Gunpowder Plot did not fail because the barrels were badly hidden. It failed because, in the early hours of 5 November 1605, somebody acted on a tip-off and searched the cellar under the House of Lords. The search found the gunpowder before the match did.
Most businesses never search their own cellar. Which is a shame, because for anyone on Microsoft 365, the search is free, takes ten minutes, and comes with a list of every barrel it finds. It is called Secure Score, and we have spent a lot of this autumn working through it with our customers. Here is why it matters, and what it keeps turning up.
What Secure Score actually is
Microsoft 365 Secure Score is a report built into every tenant. It compares how your Microsoft 365 is configured against Microsoft's own recommended security settings and gives you a percentage, along with a ranked list of improvements and how many points each one is worth. Multi-factor authentication for everyone, blocking old sign-in methods, limiting who holds admin rights, that sort of thing.
Two things are worth being clear about. First, it measures configuration, not luck. A high score means the doors are locked, not that nobody has tried them. Second, it is not a vanity metric. Nearly every item on that list is a real, documented way that businesses get broken into, ranked by how much difference closing it makes.
In the tenants we have looked through this autumn, the first glance is rarely flattering. Most businesses are nowhere near the top of the range, not because anyone did anything wrong, but because Microsoft 365 is set up to be easy to adopt, and the security settings that matter most have to be switched on deliberately.
Why this matters more now than it did a year ago
The threat picture has shifted, and not in a subtle way. The National Cyber Security Centre's latest annual review reported more than double the number of nationally significant incidents of the year before, roughly four a week. Marks & Spencer, the Co-op and Jaguar Land Rover all had their businesses stopped in their tracks last year, and not one of those attacks started with clever code. They started with people, passwords and access.
That is the pattern everywhere. Microsoft's own figures put well over nine in ten identity attacks down to passwords: guessed, sprayed, reused or stolen. Attackers no longer break in. They log in. And the thing that decides whether they can log in to your business is almost entirely the configuration that Secure Score measures.
The other shift is who gets targeted. Ransomware gangs run like businesses, and like any business they prefer easy work. They scan for tenants with the old sign-in methods still open, admin accounts without MFA, and nobody watching the logs. A low Secure Score is, quite literally, an advertisement that your cellar is unlocked.
The barrels we keep finding
Every tenant is different, but the same handful of findings come up again and again. If you recognise any of these, you have found a barrel.
- MFA that exists but is not enforced. Multi-factor authentication is switched on for some people, suggested for others, and quietly skipped by the one account that matters most. Microsoft reports that MFA blocks more than 99 percent of identity attacks. It only does that for the accounts it is actually enforced on.
- Legacy authentication still allowed. Old sign-in protocols that cannot do MFA at all, usually left open years ago for a scanner, a printer or an ancient email client. Microsoft has said that almost all password spray attacks come in through these. This is the single most common open door we find.
- Too many global admins, sometimes shared. Admin rights handed out to make a job easier and never taken back, or one "admin" login whose password several people know. One compromised global admin is the whole business, not one mailbox.
- Nothing deciding who can sign in from where. No conditional access rules, so a correct password works from anywhere in the world, on any device, at any hour.
- Mailboxes allowed to forward anywhere. A favourite of the invoice fraud gangs: get into one mailbox, add a quiet rule that copies every email to an outside address, and read the business's correspondence for months.
- Anyone can grant any app access to your data. One click on a convincing "sign in with Microsoft" prompt and a fake app has permission to read email and files, with no password needed ever again.
Not one of these takes a specialist to fix. Each is a setting. Together they are the difference between a tenant that gets picked and a tenant that gets skipped.
Why make it easy for them?
Here is the honest framing. Nobody can promise your business will never be attacked. What you control is how much effort it takes. Every barrel you remove pushes you further down the list of easy targets, and the people holding the match have plenty of easier targets to choose from. Raising a Secure Score is not about perfection. It is about no longer being the obvious one.
A word of caution before you click everything
Secure Score is a list of recommendations, not a button to press. Some items will break things if done carelessly. Block legacy authentication without checking first, and the multifunction printer stops scanning to email on Monday morning. Tighten conditional access without a plan, and the director travelling abroad is locked out of their own business. The work is in sequencing: highest points and lowest friction first, test, communicate, then the next one. Done that way, scores move a long way without anyone noticing anything except fewer strange sign-in alerts.
And a score of 100 percent is not the goal. Some recommendations do not suit every business, and some only apply with licences you may not have. A good score is one where every remaining item has a reason, and someone can tell you what it is.
The question to ask this week
If Bonfire Night prompts one action in your business, make it this question, put to whoever looks after your IT:
"What is our Microsoft 365 Secure Score, and what was it six months ago?"
A number, a trend and a short list of what is left means someone is searching the cellar. A blank look means nobody has, and it is better to find that out now than from a note in your inbox.
How we help
Reviewing and raising Secure Score is a routine part of our cyber security and Microsoft 365 work. We go through the list, explain each finding in plain English, fix the high-value items in a safe order, and report the score back so you can see it move. It fits alongside Cyber Essentials, which asks for many of the same controls, and the backup layer for the day something gets through anyway.
If you do not know your score, we will happily find it with you and tell you honestly what it says. Then enjoy the fireworks, knowing the only gunpowder anywhere near your business is in the display.