After an incident, the review opens with one question: what could that account see? Rejewski is an open-source, read-only toolkit that answers it for Microsoft 365. Its 15 tools read roles, policies, sign-in logs, and consent grants the way an adversary would after getting in, then rate each finding and map it to a control. This post is for security architects and the leaders who fund them: what a sandbox run found, how the severity and ROI lines work, and three audits to run