After an incident, the review opens with one question: what could that account see? Rejewski is an open-source, read-only toolkit that answers it for Microsoft 365. Its 15 tools read roles, policies, sign-in logs, and consent grants the way an adversary would after getting in, then rate each finding and map it to a control. This post is for security architects and the leaders who fund them: what a sandbox run found, how the severity and ROI lines work, and three audits to run

Exploitation is the most common way an intrusion starts, and the median hand-off to a second threat group was 22 seconds in 2025. This guide gives CISOs and the architects who advise them a funding order for Microsoft Defender XDR: identity coverage, then automated response, then AI in the SOC. It covers where Microsoft 365 E7 fits, 8 quick wins that use licenses you may already hold, and a business case built on your own numbers.