Could have been stopped at so many levels. We had a 'Please review this invoice' email get through. Generic email message with a PDF that had an exploit and a

Could have been stopped at so many levels. We had a 'Please review this invoice' email get through. Generic email message with a PDF that had an exploit and a web link to some low-quality impersonating site. Infected the users computer, sent a copy to everyone on their address book, got another person inside the company, sent a copy to everyone in their address book... IT staff had to manually intervene with those two users. Disable their accounts, rebuild their machines, change their passwords, etc. Who's job was it to stop that email? Was it Microsoft? Our email is hosted through them. Exchange Online boasts: Data loss prevention capabilities prevent users from mistakenly sending sensitive information to unauthorized people. Globally redundant servers, premier disaster recovery capabilities, and a team of security experts monitoring Exchange Online around the clock safeguard your data. What about Outlook itself? Advanced data, device, and file security Maybe our AV/EDR software should have caught it? AI-powered prevention, detection, response, and threat hunting across user endpoints, containers, cloud workloads, and IoT devices. Enabling modern enterprises to defend faster, at greater scale, and with higher accuracy across their entire attack surface, we empower the world to run securely. Maybe our firewalls should have caught it. Packet inspection, URL ratings, lots of things should have triggered something. And then our SIEM...I guess we had it all logged, even though we never had any warnings or messages from them. So much for millions of community submitted icidents and threat intelligence and whatever else they sell to make people sleep at night.