Question 1

I think I clicked a phishing link

Accepted Answer

1. Do not close the tab or page yet. First take a screenshot of the URL and the page. Useful for investigation.
2. Did you enter credentials? Change the password for that account and for any account where you used the same password.
3. Turn on MFA for the account if it was off. Even if data has been stolen, MFA blocks further damage.
4. Run Microsoft Defender Full Scan (not Quick) and let it finish.
5. Tell IT or your manager even if you do not see anything wrong. Better a false alarm than discovering it ran for two weeks.

When to bring us in: 
Did you enter credentials for a corporate account or banking portal: call us right away. We help revoke sessions, do log analysis, and prepare any client communication.

Question 2

A colleague's account is acting strangely

Accepted Answer

1. Disable the account immediately (Microsoft 365: Active Users > user > Block sign-in). Investigate after.
2. Force logout of all sessions (Microsoft Entra: user > Authentication > "Sign out all sessions").
3. Check the mailbox for forwarding rules. Attackers usually create a rule that auto-forwards and deletes mail.
4. Reset the password, enable MFA, then re-enable the account.
5. Reach the colleague on another channel (not mail from the suspect account) to explain what happened.

When to bring us in: 
No experience with session revoke or mailbox rules? Do not do it alone; one missed forwarding rule and the attacker stays in. We can join within an hour.

Question 3

Lost the MFA app: new phone, no backup codes

Accepted Answer

1. First text or call the admin of your work Microsoft 365 (often a colleague managing the tenant). They can do a temporary MFA reset.
2. No internal admin? Call your IT vendor (us or otherwise); they can reset in five minutes with the right rights.
3. For personal accounts (Google, Microsoft personal): use the "I lost my phone" flow. Loss of legal certainty sometimes triggers a few days of recovery delay.
4. Once back in: set MFA up on the new phone AND save backup codes in a safe place (password manager) this time.

When to bring us in: 
For business accounts: do not ask a random helpdesk to reset your MFA if you do not know them. A real attacker likes to pose as you. Call a number you already know.

Question 4

My phone is flooded with MFA pushes I did not request

Accepted Answer

1. Approve nothing. Close the Authenticator app, let the pushes pile up.
2. Change your password from another device. The attacker already has the old one, that is why the spam is happening.
3. Turn on number matching for your tenant (Entra > Security > Authentication methods > Microsoft Authenticator). Forces typing a number, blind approval becomes impossible.
4. Check Entra sign-in logs for the timestamps. Record IP and country for the incident report.
5. Tell IT even if you approved nothing. Often part of a broader campaign against multiple colleagues.

When to bring us in: 
Did you accidentally approve: treat as account takeover. Revoke sessions, check mailbox rules, call us for log analysis.

Question 5

Unexpected password-reset notification for a colleague

Accepted Answer

1. Verify on another channel first: text or call the colleague. Did they request it themselves? Often the answer is yes.
2. If not them, do NOT click the link in the email. Sign in directly via your usual route (microsoft.com/login).
3. In Microsoft 365 admin, check Sign-in logs for that user. Unusual locations or times? One signal of a real attack.
4. If suspicious: force password change, re-run MFA, revoke the user's sessions. Then investigate how it happened.

When to bring us in: 
Cannot read sign-in logs, or multiple users affected at once? Call us; this is not a "leisurely fix" case.

Question 6

Ex-employee: how do I quickly cut off all access?

Accepted Answer

1. Microsoft 365 admin: user > Block sign-in AND Reset password. Just changing password keeps active sessions open.
2. Force "Sign out all sessions" (Microsoft Entra > user > Authentication). Invalidates phone tokens and Outlook-app sessions too.
3. Remove shared mailbox access and SharePoint permissions. Do not forget shared drive mappings.
4. External services with SSO via M365 lock automatically; tools with their own logins (DocuSign, Trello, HubSpot) do not. Walk through those.
5. Change passwords for shared accounts (guest Wi-Fi, the company LinkedIn, etc.).

When to bring us in: 
On a contentious exit, or when access to client data was critical, an audit helps: what did that person recently download? We run that in the M365 Audit Log for you.

Question 7

Someone plugged in an unknown USB stick

Accepted Answer

1. Physically remove the USB. No "safe remove" needed; just pull.
2. Run Microsoft Defender Full Scan (not Quick). 30-60 minutes, but let it finish.
3. Note down: who plugged in the USB, into which laptop, when. For potential investigation.
4. Do not throw the stick away. Keep it in a sealed bag. A specialist can analyse it.
5. If the user opened files from the USB: Quick Scan those files via right-click > "Scan with Microsoft Defender".

When to bring us in: 
For laptops with access to customer data or payments: call us after scanning. A clean scan does not automatically mean no risk; we check Sign-in logs and suspicious network traffic.

Question 8

PC does not auto-lock when I walk away

Accepted Answer

1. Windows key + L locks immediately. Make it a habit on every step away, even for a minute.
2. Auto-lock: Settings > Accounts > Sign-in options > "Require sign-in" set to "When the PC wakes up". And Screensaver settings > "On resume, display logon screen" on.
3. Set screensaver time to a max of 5 minutes (Settings > Personalisation > Lock screen > Screen saver settings).
4. In office: pair Bluetooth Dynamic Lock to your phone. When the phone is out of Bluetooth range, the PC locks automatically.

When to bring us in: 
For clients we deploy this as group policy; correct on every laptop within five minutes. No longer dependent on which user remembers to set it.

Question 9

Suspicion that a leaving employee copied data

Accepted Answer

1. Disable the account immediately (block sign-in) if they are already gone. If still employed: do nothing visible until you have advice.
2. Microsoft 365 Audit Log (Audit Standard has been available in all Business/Enterprise tenants since late 2023 with 180-day retention; 1 year or more requires Audit Premium / E5): search for activities like FileDownloaded, FileSyncDownloadedFull, MailItemsAccessed in the month before departure.
3. Check OneDrive and SharePoint sharing logs: did they recently share links externally?
4. For serious cases: preserve the device (laptop, phone) without modifying it. Forensic analysis needs an untouched disk.

When to bring us in: 
This is not DIY territory. Call us or a lawyer. We do the audit-log investigation and preserve evidence properly; the lawyer handles any legal track.

Question 10

We finally want to roll out a password manager: where do we start?

Accepted Answer

1. Pick between team managers (1Password Business, Bitwarden Business, Keeper); all three are fine. Bitwarden is cheapest, 1Password has the best UX. Avoid loose personal accounts for business use.
2. First week: just you and one trusted colleague. Import your own passwords, learn how shared vaults work. Do not roll out yet.
3. Create vaults per team (Sales, Finance, IT-shared). Not one giant vault where everyone sees everything.
4. Roll out per team with a 30-minute walkthrough. Not by email. People who do not get it will keep sticky-notes on laptops.
5. Enable MFA on the password manager itself. This is now the safe, it has to be heavily protected.

When to bring us in: 
For rollouts beyond 15 people, or when shared customer credentials need to live there: let us help design the structure. Getting it right once saves a lot of mess later.

Question 11

We want to enforce MFA on all Microsoft 365 accounts

Accepted Answer

1. First check who currently has no MFA: Microsoft 365 admin > Active users > MFA Status column, or via Entra > Users > Authentication Methods per user.
2. Announce two weeks in advance to the whole team. Provide the instructions and pick a fixed enrollment day.
3. Turn on Security Defaults (Entra > Properties > Security defaults) if you do not have Conditional Access yet. That enforces MFA for all users.
4. For exceptions (POS, shared mailbox account, scanners): use service accounts with tight Conditional Access policies, or place those accounts under a separate CA exclusion. Do NOT use app passwords: Microsoft has disabled basic auth and since late 2024 you can no longer create new app passwords. Replace existing ones with OAuth flows before Microsoft fully disables them.
5. Plan a fallback slot for people who get stuck on enrollment day. Do not let anyone be locked out on a Tuesday morning.

When to bring us in: 
If you have Conditional Access licenses (Entra ID P1/P2): let us write a cleaner policy than Security Defaults, for example no MFA on office IP but yes outside. Just a bit more comfortable.

Question 12

What is Conditional Access and do we need it?

Accepted Answer

1. Check your license: Conditional Access requires Entra ID P1 or higher (included in Microsoft 365 Business Premium and up). On Business Standard you only have Security Defaults.
2. Start with one policy: 'MFA required for all users, except from trusted IP'. Usually enough for a SMB.
3. Add: 'Block sign-in from countries where we do not operate'. Limit to e.g. NL, BE, DE. Vacation exceptions happen once every six months, manageable.
4. Test in 'Report-only' mode first (Entra > Conditional Access > create policy > 'Report-only'). It logs what would happen without actually blocking.
5. Only flip to 'On' after two weeks of Report-only without weird hits.

When to bring us in: 
Conditional Access can lock you out hard if you misconfigure, including admins. First-time setup is not a solo job. We deliver a baseline set of policies that works for 90% of SMBs.

Question 13

How do I get alerted on suspicious sign-ins?

Accepted Answer

1. Entra admin center > Protection > Identity Protection > Sign-in risk policy. Turn it on and decide whether to enforce on medium or high risk (MFA or block).
2. Check live status under 'Risky users' and 'Risky sign-ins'. You see impossible travel, anonymous IP, infrequent country and other signals there.
3. Set notification recipients: you plus one backup. Not just one person, they go on vacation sometimes.
4. Test by signing in via a VPN to another country. Does the sign-in show up in 'Risky sign-ins' within 30 minutes? Configuration works.
5. Build a habit: check 'Risky users' at the start of every workday. 30 seconds of work.

When to bring us in: 
Identity Protection requires Entra ID P2. Without it you are stuck with weaker signals. Defender for Office covers a different set (mail-flow, phishing) and is a separate topic. We can advise whether the license is worth it for your situation, often not necessary.

Question 14

Too many old devices linked to our accounts

Accepted Answer

1. Entra > Devices > All devices. Sort by 'Activity' or 'Last sign-in'. Anything inactive for more than 90 days is a candidate.
2. For each suspect device: check the 'Owner' column. Still the same user? Still working here? Did they not get a new laptop ages ago?
3. Select and disable (do not delete immediately, wait 30 days, leaves room for 'oh wait, that laptop is in the attic').
4. Same for MFA methods: per user (Entra > Users > Authentication methods) you see all phones and authenticator apps. Remove old numbers.
5. Schedule this every three months. Not yearly, the pile gets too big.

When to bring us in: 
No idea which devices are 'real'? We can look at sign-in logs alongside the owner column and figure out what is safe to remove.

Question 15

We still have app passwords: is that still safe?

Accepted Answer

1. Inventory which users use app passwords: Entra > Users > Authentication methods column per user, or via PowerShell reporting.
2. Per app password: figure out which application it is for. Ask the user. Usually an old smartphone mail app or a legacy tool.
3. Find the modern equivalent: Outlook mobile, new iOS/Android Mail app, or the vendor's updated version. Almost everything supports OAuth now.
4. Replace and test. Only after the app works without app password, remove it.
5. Then disable app passwords entirely (Entra admin center > Protection > Multifactor authentication > Additional cloud-based MFA settings, or via the legacy MFA portal at account.activedirectory.windowsazure.com).

When to bring us in: 
Got a legacy line-of-business app that genuinely does not support modern auth? A service account with hard restrictions is safer than app passwords. We can advise.

Question 16

Which external apps have access to our Microsoft 365?

Accepted Answer

1. Entra > Enterprise applications > All applications. All apps where users have ever clicked 'Accept'.
2. Filter by 'Application type: Enterprise applications'. Microsoft's own apps you can ignore. External apps are the interesting ones.
3. Per app: review the permissions. 'Read all mail' or 'Send as user' on an app you do not recognize is a red flag.
4. Apps no one uses anymore: remove via 'Properties > Delete'. First test by setting 'Enabled for users to sign-in' to No and see if anyone shouts.
5. Set admin consent for risky scopes (Entra > Consent and permissions). Then users cannot self-approve mail-read scopes.

When to bring us in: 
Apps with 'Mail.ReadWrite' or 'full_access_as_app' scopes from an unknown vendor: call us, do not remove yourself. First check whether active data transfer is running before you cut anything off.

Question 17

Should we use a simulated-phishing tool?

Accepted Answer

1. Under 15 staff: not needed. A real conversation at the coffee table works better and people do not feel surveilled.
2. Above 15: consider a tool like KnowBe4, Hoxhunt or Microsoft Attack Simulation Training (in Defender for Office 365 Plan 2 / M365 E5). Microsoft is integrated, so the simplest start.
3. Announce ahead of time: 'we are going to do this, not to catch you'. Otherwise you get pushback and personal offense.
4. Keep goals reasonable: less than 5% click on simulations after three months. Not 0%, that is unrealistic.
5. Publish click rates as anonymized team numbers, not a leaderboard. Else you get rivalry instead of learning.

When to bring us in: 
Do you need to demonstrably show 'security awareness training' for an audit (customer contracts, GDPR data processing agreement)? Then a tool is worth it for the reports. We help with selection.

Question 18

How do I turn on link protection in Microsoft 365?

Accepted Answer

1. Defender > Email & collaboration > Policies & rules > Safe Links. Included from Business Premium upward.
2. Create a policy for all users. Enable 'Action for unknown potentially malicious URLs in messages'.
3. Also enable 'Apply Safe Links to email messages sent within the organization'. Catches phishing from a hacked colleague account too.
4. Test: click a link from a test mail. URL should now run via safelinks.protection.outlook.com.
5. If users ask 'my links look weird', explain: this is protection now. Do not turn it off.

When to bring us in: 
No Defender for Office 365 (not in Business Standard)? We can advise whether the upgrade is worth it for you, or a different solution fits. Not always necessary.

Question 19

How do I tag external mail so colleagues recognize it?

Accepted Answer

1. Exchange admin center > Mail flow > Rules > New rule.
2. Condition: 'Sender is located' > 'Outside the organization'. Action: 'Apply a disclaimer' > 'Prepend' with an HTML banner. Fill in 'EXTERNAL: this mail comes from outside, verify the sender'.
3. Add exceptions for partner domains you mail with a lot, otherwise every customer mail gets the banner and the signal is lost.
4. Test by sending a mail from your personal Gmail to your work mail. Banner visible?
5. Communicate to colleagues: 'if you see this banner on something that looks like a colleague mail, do not click'.

When to bring us in: 
Mailflow rule not behaving as expected or only visible in some clients? We can review the Exchange Online side and set it up cleanly.

Question 20

Someone is registering a domain that looks like ours

Accepted Answer

1. Search your own brand name: Google + 'site:' on variations (vectel, vecte1, vectell). Found something live? Screenshot for evidence.
2. Check WHOIS records (whois.nl, who.is) for registration date. Recently registered is suspect.
3. For high-risk businesses: set up a monitoring service (DNSTwister, Sucuri Lookalike, or commercial like BrandShield). Mails you on every new lookalike registration.
4. Warn your team via Teams or mail: 'watch out for mails from vectell.nl'. Better early than after the first click.
5. Keep evidence: screenshots, WHOIS, any mails. If it ever leads to CEO fraud, police will need this.

When to bring us in: 
Domain in active fraud use (customers receiving fake invoices)? Call us right away. We help with a takedown request at the registrar and temporary filter rules in your mailflow.

Question 21

Is BitLocker actually on for our laptops?

Accepted Answer

1. Per laptop: press Windows key, type 'Manage BitLocker'. See 'BitLocker on' for C: drive? You are done.
2. For central check: Microsoft Intune > Devices > Endpoint security > Disk encryption. Or Entra > Devices > BitLocker keys.
3. Not on? Click 'Turn on BitLocker'. Generates a recovery key, automatically stored in Entra if the laptop is joined there.
4. Disk gets noticeably slower during initial encryption. Do not plan this on a busy workday.
5. For laptops without TPM (older models): this is a real security downgrade. Without TPM you have to enable 'Allow BitLocker without compatible TPM' via Group Policy or Intune, and BitLocker then requires either a USB startup key or a passphrase at every boot. Workable, but the pre-boot factor is mandatory and you lose TPM protection against offline brute-force. For production hardware, replace with a device that has TPM 2.0.

When to bring us in: 
Whole fleet to BitLocker at once via Intune or GPO? Do not do it solo. One config error and you lock users out. We roll this out in phases with recovery key backup.

Question 22

Is FileVault on for our Macs?

Accepted Answer

1. On the Mac: System Settings > Privacy & Security > FileVault. Set to 'On'? Done.
2. Not on: click 'Turn On'. Choose between iCloud recovery or a local recovery key. For business: pick local recovery key, store in 1Password or a safe place.
3. Encryption starts immediately, takes 30-90 minutes in the background. Keep working.
4. For central management (multiple Macs): with Apple Business Manager + MDM (Jamf, Mosyle, Intune) you can force FileVault and pull keys.
5. Test by signing out and signing back in. Prompts for password? Good.

When to bring us in: 
No MDM and more than 5 Macs? Hard to keep central grip. We help with basic MDM selection and rollout, does not have to be expensive.

Question 23

How do I know if antivirus is still active on our laptops?

Accepted Answer

1. On Windows: open Windows Security (Start > 'Windows Security'). The 'Virus & threat protection' tab must be green. Yellow or red means act now.
2. For central view: Defender for Endpoint console (Microsoft 365 Defender > Endpoints > Device inventory). Per laptop you see health and scan history.
3. Two different AV products on one laptop is a classic issue, they see each other as virus. Remove the old one (often a Norton or McAfee trial).
4. Check 'Definitions' date. Older than 7 days is suspect, means updates are not flowing.
5. Run a fake test: download the EICAR test file (eicar.org/download-anti-malware-testfile). Working AV alerts immediately. No alert = not working.

When to bring us in: 
Defender disabled on multiple laptops with no clear reason? That is suspect, can indicate self-protecting malware. Call us for investigation.

Question 24

Our EDR tool fires alerts: what do I do with them?

Accepted Answer

1. Categorize each alert: 'Informational' (no action), 'Low' (later), 'Medium/High' (today) or 'Critical' (now). The tool already classifies, use that.
2. Medium or higher: click into details. Which user, which device, which process? Often you spot familiar work activity or not.
3. Unknown process that 'did something with PowerShell': isolate the device (in Defender: 'Isolate device'). Do not power off, keep it online for investigation.
4. Gather context on another device: did the user do something unusual? Install a new tool? Ask in person, not by email from the suspect device.
5. Do not close alerts without investigation. Better a lingering 'false positive' than something missed.

When to bring us in: 
Critical alert plus no EDR investigation experience equals call us right away. We can troubleshoot in your console within an hour. Do not draw 'quick conclusions' alone.

Question 25

How do I stop USB sticks from auto-running things?

Accepted Answer

1. Per laptop quick fix: Settings > Bluetooth & devices > AutoPlay. Turn the main toggle off. Done for that one laptop.
2. Central via Intune: Devices > Configuration > Templates > Administrative Templates > 'Turn off Autoplay' set to 'Enabled' for 'All drives'.
3. Stricter policy: block USB storage access entirely. In Intune under 'Endpoint Security > Attack Surface Reduction'. Makes USB sticks unusable, communicate first.
4. Exceptions: staff who must read customer USB sticks. Create an exception for them or use an isolated 'reading-station' laptop.
5. Test: plug in a USB. No autoplay prompt anymore? Working.

When to bring us in: 
Full USB lockdown on all devices usually meets resistance (people want to bring presentations on a stick). We advise a middle ground per role.

Question 26

Someone thinks they see something suspicious: what is the playbook?

Accepted Answer

1. Step 1: Do not power off, do not reboot, do not 'just try something'. Memory data is valuable for investigation.
2. Step 2: Take photos or screenshots of what you see. Time, screen, prompts. Does not have to be perfect.
3. Step 3: Pull the network cable or turn off Wi-Fi. Device stays on, but no longer communicates externally.
4. Step 4: Call your IT contact or vendor. Not via email from the suspect device, call from a phone or different device.
5. Step 5: Write down who did what when. Simple log: 'at 14:32 X saw this'. Helps later investigation.

When to bring us in: 
Actually suspicious activity (strange processes, ransom prompts, unknown remote tools): we come look immediately. Do not wait until you 'figure it out yourself'. The first two hours are worth gold.

Question 27

How do I isolate a laptop that might be infected?

Accepted Answer

1. Unplug the UTP cable, or turn Wi-Fi off (airplane mode is simplest). Do not power down.
2. Got Defender for Endpoint or another EDR? Use 'Isolate device' in the console. Blocks all traffic except the management channel.
3. Stick a label on the laptop: 'DO NOT POWER ON, DO NOT SIGN IN, IT CONTACT'. Stops a well-meaning colleague from 'just having a look'.
4. Keep the laptop in a lockable space until someone with investigation experience can look. Do not take home, do not hand to a colleague.
5. Document who has the laptop, from when, serial number. Store the doc on a different device.

When to bring us in: 
On suspicion of active attack (data exfiltration, ransomware): call us right away, do not investigate yourself first. Time is the difference between one laptop and the whole network.

Question 28

How do I preserve logs before rebooting a suspect device?

Accepted Answer

1. Take phone photos of what you see: running processes (Task Manager > Details), network connections, unusual prompts.
2. Open Event Viewer (Windows key + 'Event Viewer'). Under 'Windows Logs' > Security and System: export both to .evtx on an external USB. Not on the device itself.
3. For network connections: open PowerShell as admin and run 'Get-NetTCPConnection' and 'netstat -ano'. Copy the output.
4. Got more time? Microsoft has a free tool 'Process Explorer' (Sysinternals) that gives more detail. Do not install if the device is already suspect, run from USB.
5. Only then, when you have enough: reboot (or better, isolate, reboot is usually not the right first step).

When to bring us in: 
Forensic investigation is a craft. For a real breach (fraud amount, customer data exfil): we work with digital-forensics specialists. Regular IT people can destroy evidence without knowing it.

Question 29

Which password do I change first after a possible leak?

Accepted Answer

1. First: the suspect user's Microsoft 365 account. Blocks main access to mail and SharePoint.
2. Second: shared accounts and service accounts that user knew about (website admin, hosting panel, banking).
3. Third: anything tied to that M365 account via SSO. OAuth tools are revoked when you revoke sessions, but tools with separate logins (HubSpot, Trello, customer portals) are not.
4. Fourth: that user's personal passwords if they reused them. Ask honestly: 'did you also use this password somewhere personal?'.
5. Document what you changed and when. Not all verbal. A breach incident can echo for months.

When to bring us in: 
If you suspect the attacker is already inside another account: not just rotate passwords. You also need to revoke sessions and investigate. We help with the order of operations.

Question 30

How do I communicate an incident to my team without panic?

Accepted Answer

1. Honest but no details. 'There is a possible security incident, we are investigating. I will share what we know by end of day.' That is enough.
2. Give concrete actions: 'For now, change passwords, re-run MFA when asked. Do not click on new links until we say so.'
3. Designate one fixed contact for questions. Stops 'I heard from a colleague' loops.
4. Update at least once a day until resolved. Silence = people invent stories.
5. On wrap-up: short explanation of what happened, what we did, what lesson we draw. Prevents repeats.

When to bring us in: 
On larger incidents with customer communication or possible notification duty: do not write the customer mail solo. We help with phrasing that is legally and empathically sound.

Question 31

When do I have to report a data breach to the Dutch DPA?

Accepted Answer

1. Step 1, first 24 hours: determine if personal data is involved (names, mail addresses, citizen numbers, customer data). No personal data = no DPA report needed.
2. Step 2: assess risk. A customer mail address leaked is different from medical data or citizen numbers. When in doubt: report, do not skip.
3. Step 3: document. What happened, when discovered, how many people, what are the possible consequences. You must keep this in your internal breach register anyway, even if not reported.
4. Step 4: report via autoriteitpersoonsgegevens.nl > 'Datalek melden'. Online form, around 30 minutes.
5. Step 5: decide if you must also inform data subjects directly (mandatory for high risk). Mail or letter, not a social-media post.

When to bring us in: 
In doubt about reporting or communication to data subjects? Call us, we work with a GDPR lawyer for the hard cases. 72 hours is short, do not delay.

Question 32

What do I put in a DPA breach report?

Accepted Answer

1. Nature of the breach: technical (hack, malware), human (wrong mail), physical (lost laptop). Be factual, not 'we were attacked by state hackers'.
2. Number of people affected: estimate an order of magnitude. 'Unknown, estimated between 50 and 500'. Do not dramatize, do not downplay.
3. Type of data: list the categories. 'Name, email, phone'. Sensitive categories (health, financial, citizen number) call out separately.
4. Possible consequences for individuals: identity theft, financial harm, reputational damage. Be realistic.
5. Measures taken or planned: technical (password rotation, MFA enforcement), procedural (training), communication (mail to those affected).

When to bring us in: 
For a heavier notification (medical data, children, large numbers): have a GDPR expert review. We have a regular partner, one evening of work saves a lot of hassle later.

Question 33

Does this actually count as a data breach?

Accepted Answer

1. Definition: a security breach that accidentally or deliberately leads to destruction, loss, alteration, unwanted disclosure or access to personal data.
2. Examples that count: lost laptop, mail to wrong recipient with customer data, hacked account, ransomware on a fileserver with personal data.
3. Examples that usually do not: a colleague accidentally sees an open mail from another, or a paper without personal data blows away.
4. Edge cases: a lost backup tape you know is encrypted. No risk = usually no duty to report, but register internally.
5. Always store in your internal breach register. Even 'small' leaks. The DPA can request this in an audit.

When to bring us in: 
Not sure if a specific case counts? Do not guess. We have a regular GDPR lawyer who can do a short review at a reasonable rate. Much cheaper than a fine.

Question 34

Which vendors still have access to our systems?

Accepted Answer

1. Microsoft 365 admin: Active Users > filter by 'Guests'. Walk the list. Does each guest still match an active collaboration?
2. Entra > External Identities > Cross-tenant access settings: shows guest accounts from other tenants. Remove what is old.
3. For vendors with separate logins (not M365 guest): keep a simple list in Excel or Notion: vendor, contact, access type, end date.
4. Per vendor: check if they use MFA. Ask directly: 'do you use MFA on the account you work with in our systems?'. No answer = risk.
5. Schedule this audit twice a year. Do not wait longer, the layers get too thick.

When to bring us in: 
Many vendors, no overview? We build a vendor access register together with you in half a day. Costs less than an audit fine.

Question 35

People are plugging USB sticks into the reception PC

Accepted Answer

1. List which PCs are publicly accessible. Reception, meeting rooms, shared printer touchscreens.
2. Disable USB Mass Storage class via Intune or GPO for that device group. Keyboard and mouse keep working.
3. For devices where visitors do need to drop files (e.g. a printer for PDFs): use a separate transfer PC, off the corporate domain, with antivirus and network isolation.
4. Physically block unused USB ports with port blockers if the software route is unavailable. Cheap, removes the impulse.
5. Tell reception what to do if someone insists. Polite refusal, email is fine.

When to bring us in: 
We can help set up the Intune policy and a transfer PC as a one-off. Separate VLAN, antivirus, automatic reset between sessions.

Question 36

A USB stick was on the parking lot, can someone plug it in?

Accepted Answer

1. Do not plug into a work laptop. Period. Not 'just look what is on it' on a personal laptop either.
2. Store the stick in a sealed bag. Do not throw away, can be evidence.
3. Report to IT or your manager. Write down: where the stick was, when found, who found it.
4. Has someone plugged it in already? Follow the 'suspect USB' procedure: laptop offline, Defender Full Scan, possibly isolate.
5. Train your team: 'found USB = hand in, do not plug'. A few minutes in a team meeting is enough.

When to bring us in: 
Stick already plugged and files opened? Call us. We want a thorough laptop check within 24 hours. Early detection makes a big difference.

Question 37

Someone called as if they were the director, with her voice

Accepted Answer

1. First reaction: do nothing that costs money or grants access. Hang up or say 'I will call back'.
2. Call back on the phone number you have in your own contacts, not the number they called from. Caller-ID name shows, but it can be spoofed.
3. Ask a control question only the real person can answer. Not 'when is your birthday' (on LinkedIn), instead 'what did we eat at last week's team lunch'.
4. On suspicion of fraud: notify colleagues via Teams or mail (from a safe channel). Do not wait with 'maybe it was real', better safe afterwards than halfway-transferred.
5. Write the scenario for your team: 'if someone calls saying I need to transfer money, do this'. Four lines on an internal wiki.

When to bring us in: 
An actual CEO fraud attempt (urgent transfer request, pressing tone, unusual channel): call us immediately, even if nothing has happened yet. We help with police report and possibly number takedown.

Question 38

Staff use personal laptops, we don't want full MDM

Accepted Answer

1. Entra > Conditional Access > new policy for mobile and desktop apps
2. Session: app-enforced restrictions, block download outside managed context
3. iOS/Android: Intune App Protection Policy, no MDM enroll required
4. Test with one user before broad rollout

When to bring us in: 
Doubts on scope or compliance, we can review.

Question 39

We want to block or scrutinise logins from abroad

Accepted Answer

1. Entra > Security > Conditional Access > Named locations
2. Trusted: office IPs and VPN egress
3. Country: only NL/BE/DE if you never work elsewhere
4. Policy: block or require MFA outside trusted/country

When to bring us in: 
Travelling staff or remote team, drop in for exceptions.

Question 40

We want automatic response to suspicious logins

Accepted Answer

1. Entra > Identity Protection > Sign-in risk policy
2. Medium and up: require MFA
3. User risk policy: high risk = password change required
4. Report-only mode first, observe a week, then enforce

When to bring us in: 
Needs Entra ID P2 license, doubt on mix call us.

Question 41

We want to drop passwords, or pilot passwordless

Accepted Answer

1. Entra > Authentication methods > enable FIDO2 security key
2. Pilot: 2 keys per user, one in safe
3. Roll out Windows Hello via Intune for company devices
4. Only remove password when FIDO2 works for 100% of tasks

When to bring us in: 
Procurement and rollout plan, we'll handle it together.

Question 42

Microsoft is pushing passkey in Authenticator, should we follow?

Accepted Answer

1. Entra > Authentication methods > enable Passkey (Microsoft Authenticator)
2. Tell users what to do in the app
3. Optionally retire push-MFA after 4 weeks adoption
4. Admins first, then pilot group, then rest

When to bring us in: 
Mix with FIDO2 keys or legacy MFA, let's talk.

Question 43

What if all admins are locked out or MFA is down?

Accepted Answer

1. Create 1 cloud-only account, not tied to a person
2. Password 64+ characters, split between 2 people in a physical safe
3. Exclude from all Conditional Access policies
4. Alert on every sign-in via Entra or SIEM

When to bring us in: 
If you don't have one yet, set it up this week.

Question 44

Too many people permanent global admin

Accepted Answer

1. Entra > PIM > set Global Admin role to eligible instead of active
2. Activation requirements: MFA, justification, max 4 hours
3. Set approver for sensitive roles
4. Audit-log review monthly

When to bring us in: 
Needs Entra ID P2, we'll do first setup together.

Question 45

Hundreds of guests in the tenant, nobody knows who's still active

Accepted Answer

1. Entra > Identity Governance > Access Reviews
2. Review on all guests, quarterly
3. Reviewer: the inviter, fallback tenant owner
4. Auto-apply: remove if no response within 14 days

When to bring us in: 
First clean up, then set governance, two sessions.

Question 46

A user granted access to a suspicious app

Accepted Answer

1. Entra > Enterprise applications > find the app, check properties
2. User > Applications > revoke consent
3. Revoke refresh tokens for the user
4. Check mail rules and forward rules, often abused

When to bring us in: 
Doubt on what the app did, call us right away.

Question 47

Users can grant apps access to M365 data themselves

Accepted Answer

1. Entra > Consent and permissions > User consent: Do not allow
2. Admin consent requests: enable, pick reviewers
3. Document which apps are pre-approved
4. Communicate to users, otherwise tickets pile up

When to bring us in: 
If lots of SaaS already, inventory first.

Question 48

We want to block Office macro attacks and ransomware chains

Accepted Answer

1. Defender > Endpoints > ASR > set rules to audit
2. Collect for a week, identify false positives
3. Block mode for the safe set: 7 rules with low impact
4. Exceptions by path, not by executable

When to bring us in: 
Critical rules vary by sector, happy to discuss.

Question 49

We want ransomware protection for Documents and Desktop

Accepted Answer

1. Defender > Ransomware protection > Controlled folder access
2. Audit mode first, see what writes
3. Add own apps to allow list
4. Block mode and support users on allow requests

When to bring us in: 
Lots of custom apps, we help with allow list.

Question 50

Users download anything, how do I block unknown exes?

Accepted Answer

1. Check Windows Security > App & browser control > Smart App Control
2. Status must be 'Evaluation' or 'On' after clean install
3. If Off: only reset brings it back, that's a choice
4. Combine with SmartScreen for browser downloads

When to bring us in: 
Custom unsigned software, different path.

Question 51

Windows Security says Memory Integrity is off

Accepted Answer

1. Windows Security > Device security > Core isolation
2. Memory integrity on, reboot
3. On conflict: error names the driver, update or replace
4. Intune policy to enforce on fleet

When to bring us in: 
Old business driver breaking HVCI, we'll review.

Question 52

We want to block risky site categories without a separate proxy

Accepted Answer

1. Defender portal > Endpoints > Web content filtering
2. Pick categories, scope on device group
3. Tunable per group, no one-size-fits-all
4. Reports in Defender, not in Edge itself

When to bring us in: 
Conflicts with DNS filter, pick one main tool.

Question 53

Allow USB read, block write

Accepted Answer

1. Intune > Endpoint security > Attack surface reduction > Device control
2. Removable storage policy: write deny, read allow
3. Approved USB IDs on allow list for specific teams
4. Audit log to Defender for deviations

When to bring us in: 
Workflows that need write, exception case by case.

Question 54

We want to block exec and domain impersonation

Accepted Answer

1. Defender > Email & collaboration > Policies > Anti-phishing
2. Mailbox intelligence on
3. Impersonation: explicitly protect execs
4. Spoof mail: quarantine instead of junk

When to bring us in: 
False positives on partners, we'll build the allow list.

Question 55

Attachments delay mail delivery due to Safe Attachments scan

Accepted Answer

1. Defender > Policies > Safe Attachments
2. Action: Dynamic Delivery
3. Redirect blocked attachments to security-team mailbox
4. Test with EICAR attachment or safe sample

When to bring us in: 
Workflows automating attachments, dynamic delivery sometimes breaks.

Question 56

Users keep asking if quarantined mail was really phishing

Accepted Answer

1. Defender > Email & collaboration > Quarantine policies
2. Spam: allow end-user release
3. Phish/malware: admin-only release
4. Daily quarantine notification instead of per-mail

When to bring us in: 
Tuning to your volume, we'll handle it.

Question 57

How do users report suspicious mail to Defender?

Accepted Answer

1. Defender > Policies > User reported settings
2. Configure reporting mailbox, also send to Microsoft
3. Outlook: enable built-in Report button via policy
4. Check submissions portal weekly

When to bring us in: 
Using own reporting tool, integration via header.

Question 58

No idea which SaaS tools staff use

Accepted Answer

1. Defender for Cloud Apps > Cloud Discovery
2. Log uploader or integration with Defender for Endpoint
3. First report within 48 hours
4. Sanctioned/unsanctioned tagging by risk

When to bring us in: 
Findings that need cutting, block via DNS or policy.

Question 59

Someone suddenly downloads 5GB from SharePoint, normal?

Accepted Answer

1. Defender for Cloud Apps > Policies > Anomaly detection
2. Mass download: tune threshold to normal use
3. Auto action: suspend account on high severity
4. Alert receiver: SOC or IT mailbox

When to bring us in: 
Real incident: suspend account, then investigate.

Question 60

Sensitivity labels or DLP, what fits?

Accepted Answer

1. Start with labels: Public, Internal, Confidential
2. Auto-label on core patterns (BSN, contract numbers)
3. DLP policy: block external share of Confidential label
4. Pilot in 1 department for 4 weeks

When to bring us in: 
Sector compliance (NEN 7510, ISO), label mapping together.

Question 61

Our sector falls under NIS2, what must the board do?

Accepted Answer

1. Determine essential or important entity
2. Risk analysis at board level, yearly
3. Cyber risk training for board, documented
4. Incident reporting within 24h to CSIRT (DTC or NCSC)

When to bring us in: 
Compliance track, we set it up with legal.

Question 62

We want to practice once what we do in a ransomware attack

Accepted Answer

1. Scenario: e.g. finance system encrypted Friday afternoon
2. Participants: exec, IT, comms, legal
3. Facilitator injects incidents in phases
4. Final report with 5-10 actions and deadlines

When to bring us in: 
We facilitate if too close to lead yourself.

Question 63

How do I know if our vendors are well-secured?

Accepted Answer

1. Inventory top-10 vendors by data access
2. Send short questionnaire: certification, MFA, incident history
3. Request external rating or subscribe
4. Insufficient score = SLA change or replacement

When to bring us in: 
Doubt on a specific vendor, we tackle together.

Question 64

What are 'appropriate measures' under GDPR art. 32?

Accepted Answer

1. Encryption at-rest and in-transit for personal data
2. MFA on all accounts with personal data access
3. Backup with tested restore process
4. Document the reasoning, the DPA asks at incident

When to bring us in: 
Doubt on 'appropriate', external audit-light.

Security