Business email compromise is now the leading cause of cyber-related financial loss, and the signals most IT teams rely on to catch it no longer hold up. Host Nathan Taylor and Petra Security Co-founder and COO Nathan Ostrowski explain how residential proxies, phishing toolkits, and SEO phishing let attackers log in from your users’ own cities.

Not sure whether an attacker is already signed in to one of your Microsoft 365 accounts? Talk with the Sourcepass Center of Excellence for Microsoft about a free Microsoft 365 Identity Threat Assessment, powered by Petra. You’ll see which accounts are affected, how the attacker got in, how long they had access, and what they opened, forwarded, or deleted, along with prioritized recommendations for hardening your tenant. Take the Assessment here: https://go.fame.so/sourcepasspetra

They cover why location-based conditional access falls short, how behavioral identity threat detection and response (ITDR) catches Microsoft 365 account takeover in under a minute, and which tenant hardening steps reduce your exposure.

What You’ll Learn:

How residential proxies let attackers sign in from a user’s own city without being flagged as a VPN
Why legacy location lockouts and geo-blocking conditional access policies can do more harm than good
How behavioral profiling across Exchange, SharePoint, and Teams logs spots account takeover that sign-in data misses
How attackers registered a compliant device to compromise a CEO
What SEO phishing is and why poisoned “Microsoft password reset” results are driving a wave of attacks
Why one compromise per 500 identities per month is a realistic baseline
Which Microsoft 365 hardening steps cut your attack surface the most

About the Guest:

Nathan Ostrowski is the COO and Co-founder of Petra Security, which provides identity threat detection and response (ITDR) for Microsoft 365. Petra builds behavioral profiles for every user in a tenant by correlating sign-in, Exchange, SharePoint, and Teams activity. That lets it tell a legitimate user from an attacker, shut down account takeover as it happens, and produce detailed forensics after a compromise.

About the Host:

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Episode Highlights:

01:33 Defining Identity Threat Detection and Response

Business email compromise now tops the FBI’s list of costly cyberattacks. Nathan explains what identity threat detection and response (ITDR) covers, from account takeover and session theft to the fraud that follows.

03:09 Why Location-Based Detection Stopped Working

Most identity attacks now come from inside the US, often from the user’s own city. Nathan explains why traditional SIEM rules miss them and how per-user behavioral profiles catch what sign-in location can’t.

11:34 A CEO Compromised From His Own Hometown

Despite layered security tools and compliant-device enforcement, one CEO was compromised from a residential proxy in his small hometown. The attacker then registered a compliant device through a Microsoft Authentication Broker gap.

14:39 Microsoft 365 Breach Forensics in a Day

As you know, investigating a compromise through the Microsoft Entra ID portal is slow and error-prone. Petra’s forensic reports show how attackers got in, how long they stayed, and what they touched, often catching mailbox rules and devices a manual review missed.

17:48 One Compromise Per 500 Identities

Stolen sessions are bought and sold, and attackers often wait before acting. Petra sees about one compromise per 500 identities per month. If you aren’t seeing that rate, something may be going unnoticed.

19:12 Why a 56-Second Response Time Matters

Automated toolkits do their most valuable work in the first ten minutes. Correlating logins, mailbox rules, and new devices in real time can stop an attacker before sensitive financial data leaves the mailbox.

21:48 Hardening Recommendations for Microsoft 365

Nathan shares the changes with the biggest impact: disabling direct send, moving toward passkeys and compliant devices, and tightening SPF and DKIM. He also explains SEO phishing, which poisons “Microsoft password reset” search results.

Episode Resources:

Nathan Ostrowski on LinkedIn
Petra Security Website
Microsoft Website
Sourcepass Website
Nathan Taylor on LinkedIn

Quotes:

“Identity has become the frontier for everything. 90% of all attacks. That is an insane statistic.”
“The harsh reality is that even if you do all these things, there’s still a need for detection and response, always.”
“At the very top of cyber investment still people lose a ton of money to cyber investment schemes. The first cyber attack that costs people money is business email compromise.”
“Residential proxies are something that AI companies use to scrape the Internet. What you're going to do is you're going to use a residential proxy which uses real users devices and goes through those real user devices.”
“I actually don't think that people should set up conditional access policies to block outside US logins. Every time somebody is traveling they're going to get a little bit jaded about the cyber program and so you will lose so much organizational buy in.”
“Identity is the frontier. The harsh reality is that even if you do all these things, there's still a need for detection.”