Sourcepass
Businesses are often held back by lackluster technology vendors that leave them underserved and overcharged for IT services.
An opportunity existed for innovation through leveraging Software-as-a-Service (SaaS) technologies such as Artificial Intelligence (AI) and Robotic Process Automation (RPA) married with premier managed services to provide a revolutionary client experience.
As a result, Sourcepass was born with the vision to provide businesses of all sizes a technology experience that elevates their company.
Sourcepass puts you in control of your digital universe, so you have the power to transform your business.
With Sourcepass, you have a team of guardians that maintains data networks, manages cloud and security monitoring, and guides productivity and digital transformation. The right blend of technologies work seamlessly and powerfully, backed and boosted by our tech smarts and business savvy.
NYSDOH Cybersecurity Requirements for Water Districts: 2027 Compliance Guide
Cybersecurity has become a critical component of protecting public infrastructure. Recognizing the growing threats targeting essential services, the New York State Department of Health (NYSDOH) has established cybersecurity requirements for public water systems that must be met by January 1, 2027.
Cybersecurity has become a critical component of protecting public infrastructure. Recognizing the growing threats targeting essential services, the New York State Department of Health (NYSDOH) has established cybersecurity requirements for public water systems that must be met by January 1, 2027.
Read full post on blog.sourcepass.com
CMMC Phase II Suspension: Cybersecurity Next Steps | Sourcepass
The CMMC Phase II suspension changes how some defense contractors may need to demonstrate cybersecurity compliance, but it does not remove the need to protect Controlled Unclassified Information, maintain an accurate compliance posture, or continue implementing required security controls. For executives, operations leaders, and IT decision-makers, the practical question is not whether to pause. It is how to keep compliance efforts moving while the government reviews the assessment mechanism.
The CMMC Phase II suspension changes how some defense contractors may need to demonstrate cybersecurity compliance, but it does not remove the need to protect Controlled Unclassified Information, maintain an accurate compliance posture, or continue implementing required security controls. For executives, operations leaders, and IT decision-makers, the practical question is not whether to pause. It is how to keep compliance efforts moving while the government reviews the assessment mechanism.
Read full post on blog.sourcepass.com
Roll Out FIDO2 Passkeys in Microsoft 365 Without Chaos | Sourcepass
For many small and mid-sized businesses (SMBs) running on Microsoft 365, multifactor authentication (MFA) is no longer a differentiator. It is a baseline control. The problem is that many widely used MFA methods remain vulnerable to adversary-in-the-middle phishing, MFA fatigue attacks, and social engineering techniques that target user behavior rather than technical weaknesses. As cyber insurance requirements, client security questionnaires, and regulatory expectations continue to evolve, organizations are increasingly being asked whether they have implemented phishing-resistant MFA rather
For many small and mid-sized businesses (SMBs) running on Microsoft 365, multifactor authentication (MFA) is no longer a differentiator. It is a baseline control. The problem is that many widely used MFA methods remain vulnerable to adversary-in-the-middle phishing, MFA fatigue attacks, and social engineering techniques that target user behavior rather than technical weaknesses. As cyber insurance requirements, client security questionnaires, and regulatory expectations continue to evolve, organizations are increasingly being asked whether they have implemented phishing-resistant MFA rather than simply enabled MFA. FIDO2 passkeys provide a practical path forward. By replacing passwords and one-time codes with cryptographic credentials tied to trusted devices and legitimate domains, passkeys help reduce the risk of credential theft while simplifying the user experience. Microsoft documents that passkeys in Microsoft Entra ID are designed to help prevent phishing by binding authentication to the legitimate sign-in origin, reducing opportunities for credential replay attacks. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2 For SMB leaders, the challenge is rarely whether passkeys are beneficial. The challenge is how to implement FIDO2 passkeys in Microsoft 365 without disrupting operations, overwhelming users, or creating new support burdens. Why SMBs Must Move from Basic MFA to FIDO2 Passkeys Traditional MFA methods such as SMS codes, authenticator push notifications, and one-time passcodes improve security compared to passwords alone. However, they rely on credentials or temporary codes that attackers can potentially capture, relay, or manipulate through phishing campaigns. FIDO2 passkeys fundamentally change the authentication process. Instead of sending reusable secrets across the authentication flow, passkeys rely on public-key cryptography stored locally on a trusted device or hardware security key. The private key never leaves the device, making credential theft significantly more difficult. For Microsoft 365 organizations, this provides several operational advantages: Reduced exposure to phishing attacks Stronger protection for privileged accounts Improved alignment with Zero Trust principles Better support for cyber insurance requirements Reduced dependency on passwords Passkeys can also improve the employee experience. Users authenticate with familiar methods such as Windows Hello biometrics, device PINs, or approved security keys instead of managing complex passwords and secondary authentication prompts. Organizations interested in a Microsoft-focused implementation roadmap can reference Microsoft's official passkey guidance and practical SMB-focused deployment recommendations from sources such as https://blog.sourcepass.com/sourcepass-blog/rolling-out-fido2-passkeys-in-microsoft-365-tenants-sourcepass. Why Cyber Insurance and Client Requirements Are Shifting Many cyber insurers and enterprise clients now assess authentication controls more deeply than they did previously. Security questionnaires increasingly distinguish between basic MFA and phishing-resistant MFA. This shift reflects a practical reality: attackers frequently target user authentication because it remains one of the most effective paths to account compromise. Organizations that demonstrate structured adoption of phishing-resistant authentication are often better positioned to meet evolving security expectations. Why FIDO2 Passkeys Fit Microsoft 365 Environments Microsoft Entra ID supports FIDO2 security keys and passkeys as part of a passwordless authentication strategy. This integration allows organizations to strengthen authentication while leveraging existing Microsoft identity controls such as: Conditional Access Identity Protection Windows Hello for Business Device compliance policies Microsoft Zero Trust architecture Microsoft's guidance for SMBs highlights identity security as a foundational Zero Trust pillar because identity compromise remains a leading path to broader business disruption (https://learn.microsoft.com/en-us/security/zero-trust/guidance-smb-partner. Design a Phased FIDO2 Rollout for High-Risk SMB Users First A successful FIDO2 rollout is primarily an operational project rather than a technical project. Organizations that attempt large-scale authentication changes without planning often create unnecessary user frustration and support challenges. A phased deployment approach reduces risk while allowing IT leaders to improve processes before broader adoption. Identify High-Risk Accounts and Business Functions Begin by identifying the user populations that represent the highest risk if compromised. For most SMBs, this includes: IT administrators Executive leadership Finance teams Human resources personnel Users with access to sensitive client data Individuals authorized to approve payments or contracts Document how these users currently authenticate and identify common work scenarios such as office-based work, remote work, travel, and shared workstation usage. This assessment helps determine whether device-based passkeys, hardware security keys, or a combination of both methods will provide the most practical and secure experience. Launch a Focused Pilot Program Instead of replacing authentication methods across the organization simultaneously, start with a small pilot group. A strong pilot often includes: IT administrators Security champions Executive sponsors Operational leaders willing to provide feedback Enable passkeys alongside existing authentication methods rather than immediately removing alternatives. This approach provides a safety net while users become comfortable with the new sign-in process. Follow Microsoft's implementation guidance for registering FIDO2 passkeys and security keys within Microsoft Entra ID (https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2). Measure User Friction Before Expansion User adoption determines the success or failure of any authentication initiative. During the pilot phase, collect feedback regarding: Registration challenges Sign-in confusion Device compatibility issues Recovery processes for lost devices Application compatibility concerns The objective is not merely technical deployment. The objective is reducing friction while improving security outcomes. Once pilot issues are resolved, expand adoption in clearly defined waves: Administrative accounts Executive accounts Finance and HR teams Client-facing personnel Broader user populations Throughout deployment, connect passkeys to business outcomes rather than technical terminology. Employees are more likely to support adoption when they understand the operational benefits, including easier sign-ins and reduced password-related disruptions. Integrate Passkeys into a Broader Zero Trust Strategy FIDO2 passkeys should not operate as a standalone control. Organizations will achieve better outcomes when passkeys are combined with: Conditional Access policies Device compliance requirements Legacy authentication protocol blocking Identity governance processes Ongoing security monitoring Microsoft recommends a layered Zero Trust approach in which identity, device health, and access policies work together (https://learn.microsoft.com/en-us/security/zero-trust/guidance-smb-partner). For many SMBs, this also aligns with broader governance efforts such as NIST Cybersecurity Framework (CSF) adoption and identity-centric security programs. Maintain Evidence and Metrics for FIDO2 Success Authentication improvements often lose momentum when organizations fail to measure adoption and outcomes. Without visibility into deployment progress, exceptions accumulate, phishing-resistant MFA coverage declines, and legacy authentication methods remain in use longer than intended. Track Passkey Coverage Among Priority Users Start by measuring passkey adoption among the highest-risk user groups. Metrics may include: Percentage of privileged users registered with passkeys Percentage of executive users registered with passkeys Number of remaining authentication exceptions Percentage of users still dependent on SMS-based MFA Microsoft Entra ID reporting can help organizations monitor authentication method adoption and identify gaps requiring remediation (https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2). Leadership should receive simple business-oriented reporting that demonstrates progress against established security objectives. Measure Operational Improvements Security controls should improve both protection and operational efficiency. Track metrics such as: Password reset volume MFA-related support tickets Authentication lockout incidents Average help desk resolution time These measurements help demonstrate whether passkey deployment has reduced administrative overhead while improving security resilience. Monitor Identity Security Outcomes Passkeys are not a complete solution to every identity threat, but they can significantly reduce exposure to phishing-based account compromise. Organizations should routinely review: Risky sign-in activity Account compromise attempts Identity Protection alerts Privileged account monitoring data Authentication exception requests Combining passkey adoption metrics with broader identity security monitoring provides a more complete picture of risk reduction. Make Passkeys Part of Governance Long-term success requires operational consistency. Organizations should incorporate passkey registration into: New employee onboarding Privileged access reviews Identity governance programs Cyber insurance documentation Security questionnaire responses Including passkey coverage in governance dashboards helps prevent authentication controls from weakening over time. FIDO2 passkeys deliver their greatest value when treated as an ongoing identity security practice rather than a one-time technology deployment. For Microsoft 365 organizations, a structured rollout supported by measurable adoption metrics, user education, Conditional Access controls, and governance processes creates a more resilient identity environment while reducing operational friction. FAQ What are FIDO2 passkeys in Microsoft 365? FIDO2 passkeys are phishing-resistant authentication credentials that use public-key cryptography instead of passwords. In Microsoft 365, passkeys integrate with Microsoft Entra ID and allow users to authenticate using trusted devices, biometrics, or security keys. Why are FIDO2 passkeys considered phishing-resistant MFA? Passkeys are tied to legitimate websites and applications through cryptographic validation. Because there is no reusable password or one-time code to steal, attackers have far fewer opportunities to capture credentials through phishing attacks. Should SMBs replace MFA with passkeys? Most organizations should view passkeys as an evolution of MFA rather than a complete replacement initiative. A phased deployment approach allows companies to strengthen authentication while maintaining business continuity and user adoption. Who should receive FIDO2 passkeys first? High-risk users should typically be prioritized first. This includes administrators, executives, finance personnel, HR teams, and employees with access to sensitive business or client information. How do FIDO2 passkeys support Microsoft Zero Trust strategies? Passkeys strengthen the identity pillar of Zero Trust by reducing reliance on passwords and helping verify that authentication requests originate from legitimate users on trusted devices. When combined with Conditional Access and device compliance policies, they contribute to a stronger overall security posture.
Read full post on blog.sourcepass.com
Microsoft Purview and Copilot: Protecting Data in the Age of AI
Artificial intelligence is changing how organizations create content, access information, and make decisions. Microsoft 365 Copilot is helping businesses realize those benefits by bringing AI directly into applications such as Teams, Outlook, Word, Excel, and SharePoint.
Artificial intelligence is changing how organizations create content, access information, and make decisions. Microsoft 365 Copilot is helping businesses realize those benefits by bringing AI directly into applications such as Teams, Outlook, Word, Excel, and SharePoint.
Read full post on blog.sourcepass.com
How Copilot in Teams Is Changing Workplace Productivity
For many organizations, meetings have become both essential and overwhelming. Employees spend significant portions of their workday in virtual meetings, reviewing chat conversations, tracking action items, and searching for information shared across multiple discussions.
For many organizations, meetings have become both essential and overwhelming. Employees spend significant portions of their workday in virtual meetings, reviewing chat conversations, tracking action items, and searching for information shared across multiple discussions.
Read full post on blog.sourcepass.com
Stopping Invoice Fraud in Microsoft 365 Workflows | Sourcepass
Invoice fraud in Microsoft 365 finance workflows is a business process risk, not just an email security problem. Attackers often use business email compromise, vendor email compromise, and payment redirection tactics to make fraudulent requests look like normal accounts-payable activity. The common pattern is simple: a trusted vendor relationship is impersonated or compromised, a payment detail change is requested, and the finance workflow processes the change before anyone independently verifies it. For SMB executives, operations leaders, and IT decision-makers, the goal is measurable risk
Invoice fraud in Microsoft 365 finance workflows is a business process risk, not just an email security problem. Attackers often use business email compromise, vendor email compromise, and payment redirection tactics to make fraudulent requests look like normal accounts-payable activity. The common pattern is simple: a trusted vendor relationship is impersonated or compromised, a payment detail change is requested, and the finance workflow processes the change before anyone independently verifies it. For SMB executives, operations leaders, and IT decision-makers, the goal is measurable risk reduction. That means combining Microsoft 365 identity security, Defender for Office 365 email controls, accounts-payable verification rules, and reporting metrics that show whether behavior is changing. Microsoft 365 is central because Outlook, Teams, SharePoint, and identity controls are where invoice approvals, vendor conversations, and payment-related documents often move. Microsoft states that business email compromise uses forged trusted senders to trick recipients into approving payments, transferring funds, or revealing customer data. [learn.microsoft.com] Why Invoice Fraud Works in Microsoft 365 Finance Workflows Invoice fraud works because it blends into an existing business process. A fraudulent payment request may reference a real invoice, a real vendor, or an active email thread. Abnormal AI describes invoice redirection fraud as a business email compromise variant where attackers intercept or impersonate vendors to redirect legitimate payments to attacker-controlled accounts. [abnormal.ai] Traditional phishing controls are important, but invoice fraud often does not rely on obvious malware or suspicious links. Abnormal AI notes that invoice redirection fraud is often payload-less, targets real workflows, and focuses on changing payment details rather than stealing credentials directly. [abnormal.ai] For SMBs, this creates a specific operational problem. If the finance team treats email as sufficient evidence for bank detail changes, the organization is relying on individual judgment at the exact moment attackers are trying to create urgency, familiarity, and trust. Treat Vendor Payment Changes as High-Risk Events A payment change request should never be treated as routine vendor maintenance. It should be treated as a controlled financial event. Create a no-exceptions verification rule The first behavioral control is clear: no vendor banking change, payment redirection, or one-time urgent payment should be approved based only on email, Teams chat, text message, or a document attached to the request. A practical verification workflow should require: Out-of-band confirmation using a phone number or vendor portal already on file Dual approval before any vendor bank detail is changed Documentation of who verified the request, how it was verified, and when A hold period or secondary review for high-value or unusual payment changes Review of supporting documents before they are stored or trusted The Sourcepass guidance on vendor email compromise emphasizes that defending payables in Microsoft 365 requires identity protection, mail flow controls, data safeguards, and finance process verification working together. [blog.sourcepass.com] Separate communication from authorization A legitimate vendor may communicate through email, but authorization should happen through a controlled workflow. This distinction matters because a compromised vendor mailbox can still send a message that looks authentic. Abnormal AI notes that vendor impersonation fraud can succeed because it may contain no malicious payload, pass email authentication, and exploit established supplier trust. [abnormal.ai] The finance control should be designed around that reality. The question is not “Does this email look real?” The question is “Has this requested change passed the approved verification process?” Harden Microsoft 365 Identity Controls for Finance Users Invoice fraud often starts with identity misuse. For finance teams, identity security is a business control. Require strong authentication for AP and payment roles Accounts-payable, treasury, finance leadership, and users who approve vendor changes should have stronger access controls than general users. Microsoft Entra ID and Conditional Access can help reduce the likelihood that compromised credentials lead to mailbox or finance-system access. Microsoft’s baseline security guidance emphasizes foundational controls across identity, devices, data, and networks, and highlights the importance of protecting privileged roles. [learn.microsoft.com] For finance workflows, the baseline should include: Multifactor authentication for all users Stronger authentication requirements for AP, treasury, and administrators Conditional Access policies for finance applications and Microsoft 365 access Blocking legacy authentication where it is still enabled Regular review of mailbox permissions, shared mailboxes, and delegated access Monitor risky mailbox behavior Business email compromise can involve more than a single fraudulent message. Attackers may create inbox rules, hide responses, forward mail externally, or monitor payment conversations before acting. The Sourcepass BEC response runbook recommends reviewing inbox rules, transport rules, connectors, and forwarding configurations during business email compromise investigation. [blog.sourcepass.com] For prevention, monitor finance mailboxes for: New external forwarding rules Suspicious inbox rules that move or delete messages Unusual delegated access Sign-ins from unexpected locations or devices OAuth consent changes tied to finance users These are operational signals, not just security events. Finance leadership should understand them because they affect payment integrity. Configure Defender for Office 365 Around Vendor and Payment Risk Microsoft Defender for Office 365 should be tuned for the people and workflows most exposed to invoice fraud. Use anti-phishing and impersonation protection Microsoft states that anti-phishing policies protect against phishing attacks by detecting spoofed senders, impersonation attempts, and other deceptive email techniques.[learn.microsoft.com] Microsoft also notes that Defender for Office 365 provides impersonation protection for user, domain, and sender impersonation, along with trusted sender and domain configuration to help reduce false positives. [learn.microsoft.com] For finance workflows, configure policies around: AP shared mailboxes Finance distribution lists Executive approvers Key vendor domains Common look-alike domains New senders asking about payment changes Microsoft explains that domain impersonation can involve subtle differences in a domain, and that impersonated domains may pass regular authentication checks because they can be real registered domains created to deceive [learn.microsoft.com] Use Safe Links and Safe Attachments where licensed Invoice fraud may be payload-less, but finance teams still receive malicious links and attachments. Microsoft describes Safe Links as providing URL scanning, URL rewriting during mail flow, and time-of-click verification in email, Teams, and supported Microsoft 365 apps. [abnormal.ai] Microsoft describes Safe Attachments as opening attachments in a virtual environment before delivery to identify harmful files. [abnormal.ai] These controls should not replace AP verification. They reduce exposure to malicious content while the finance workflow reduces exposure to fraudulent payment changes. Strengthen Email Authentication and Mail Flow Email authentication helps reduce spoofing and improves confidence in sender identity, but it does not eliminate vendor fraud by itself. Microsoft explains that SPF specifies the source email servers allowed to send for a domain, DKIM digitally signs important message elements, and DMARC specifies what action to take when SPF or DKIM checks fail. [learn.microsoft.com] Microsoft also states that these standards work together and that using less than all email authentication methods results in weaker protection against spoofing and phishing. [learn.microsoft.com] A practical SMB baseline should include: SPF, DKIM, and DMARC for the organization’s own domains Review of third-party systems that send email on behalf of the business Monitoring for failed authentication on payment-related messages Controls that block or restrict automatic external forwarding External sender labels or warnings for finance users Sourcepass also recommends strengthening domain hygiene with SPF, DKIM, and DMARC and disabling automatic forwarding to external domains by default as part of defending payables in Microsoft 365. [blog.sourcepass.com] Embed Controls in ERP and Accounts-Payable Systems Microsoft 365 controls reduce email and identity risk. ERP and AP controls reduce the chance that a fraudulent request becomes a completed payment. Use vendor bank approval workflows where available For organizations using Dynamics 365 Finance, Microsoft documents a vendor bank account workflow that helps reduce the risk of fraud by detecting and preventing unapproved changes to supplier bank account information. [learn.microsoft.com] Microsoft states that this workflow can require approval for new vendor bank account records and for updates to existing records, depending on configuration. [learn.microsoft.com] If your organization uses Dynamics 365 Business Central or another ERP, confirm whether vendor bank changes can be locked, routed for approval, or restricted from payment until reviewed. Where the ERP does not support this natively, use compensating controls such as: Separate permissions for vendor master data changes Required approval tickets for bank changes Payment holds after bank detail updates Secure storage of verified documents Audit trails for every vendor bank change Protect the vendor master record The invoice may be legitimate, the purchase order may be legitimate, and the approval may be valid. The fraud can still succeed if the vendor master record has been changed to the wrong bank account. That is why AP teams should measure vendor data integrity, not just invoice approval speed. Every vendor bank change should leave a record that finance, audit, IT, and leadership can review. Train Finance Teams on the Specific Moment of Risk General security awareness is not enough for invoice fraud. The training must focus on the decision points where money can move. Teach the “pause, verify, document” behavior Employees should be trained to pause when they see: A vendor asking to change bank details A request to use a different payment method A request that bypasses the normal approval chain A message that references urgency tied to month-end, service interruption, or executive pressure A bank statement, voided check, or PDF provided as the only proof The expected behavior should be simple: pause, verify through the approved channel, and document the outcome. Make reporting easy in Outlook Users should know how to report suspicious messages from Outlook, especially in AP, procurement, finance leadership, and executive assistant roles. Fast reporting gives IT or a managed security provider a chance to investigate before the request becomes a payment. Microsoft advises reporting phishing messages to Microsoft because it helps tune filters that protect Microsoft 365 customers.[learn.microsoft.com] Measure Invoice Fraud Risk Reduction The most useful invoice fraud program is measurable. SMB leaders should track whether controls are working and whether behavior is improving. Use a finance and security scorecard A concise monthly scorecard should include: Percentage of vendor bank changes that followed the approved verification workflow Number of vendor change requests rejected or escalated after out-of-band verification Number of payment-change emails reported by users Number of impersonation or spoofing attempts detected by Microsoft 365 controls Number of suspicious inbox rules or external forwarding attempts found in finance mailboxes Percentage of finance users covered by MFA and appropriate Conditional Access policies Time from suspicious message receipt to user report Number of exceptions approved and the business reason for each exception Microsoft 365 security reports, Defender for Office 365 alerts, Entra ID sign-in data, ERP approval logs, and AP ticket records can all support this scorecard when properly configured. Review the scorecard with finance and IT together Invoice fraud sits between finance operations and cybersecurity. A short monthly review should include finance leadership, IT, and any managed security or managed IT provider supporting Microsoft 365. The review should answer three questions: Did every vendor bank change follow the approved workflow? Did Microsoft 365 detect or block suspicious vendor or payment-related activity? Did any employee bypass the process, and what control needs to change? This turns invoice fraud prevention into a managed business process instead of an occasional reminder. How Managed Security Supports SMB Finance Workflows Many SMBs do not have dedicated security teams watching Microsoft 365 alerts, finance mailbox activity, and identity risk every day. Managed security can help by keeping the controls active, tuned, and reviewed. The right managed approach should focus on outcomes: Finance mailboxes are monitored for suspicious rules and forwarding Defender for Office 365 policies are configured around high-risk roles Entra ID and Conditional Access reports are reviewed for risky activity Vendor change workflows are documented and tested AP and IT review exceptions together Incidents are investigated with evidence preserved This is not about outsourcing accountability. It is about giving SMB leaders a repeatable operating model that reduces risk without asking lean teams to monitor every control manually. FAQ What is invoice fraud in Microsoft 365? Invoice fraud in Microsoft 365 is a payment fraud scenario where attackers use Outlook, Teams, SharePoint, or compromised identity access to make a fraudulent invoice or vendor payment request appear legitimate. It often overlaps with business email compromise, vendor email compromise, and invoice redirection fraud. How does Microsoft 365 help stop invoice fraud? Microsoft 365 helps reduce invoice fraud through identity controls, email authentication, Defender for Office 365 anti-phishing policies, Safe Links, Safe Attachments, mailbox monitoring, and audit data. These controls are most effective when paired with accounts-payable workflows that require independent verification before vendor bank details or payment instructions are changed. What is vendor email compromise? Vendor email compromise is a type of business email compromise where attackers impersonate or compromise a trusted supplier and use that relationship to request payment changes. Sourcepass describes vendor email compromise as targeting accounts payable by compromising or impersonating real suppliers and requesting banking detail changes or rush payments. [blog.sourcepass.com] Are SPF, DKIM, and DMARC enough to stop invoice fraud? No. SPF, DKIM, and DMARC help authenticate email and reduce spoofing, but they do not prove that a payment change request is legitimate. Microsoft states that SPF, DKIM, and DMARC work together to protect against spoofing and phishing, but invoice fraud can also come from compromised vendor accounts or convincing look-alike domains.[learn.microsoft.com] What should accounts payable do when a vendor asks to change bank details? Accounts payable should pause the request, verify it through an approved out-of-band channel, require dual approval, document the verification, and only then update the vendor record. The contact information used for verification should come from a trusted source already on file, not from the email requesting the change. Which Microsoft 365 users need stronger invoice fraud controls? Stronger controls should apply to AP users, finance leaders, treasury staff, executive approvers, administrators, and anyone with access to vendor data or payment workflows. These users should have MFA, appropriate Conditional Access policies, and monitoring for suspicious mailbox activity. How should SMBs measure invoice fraud prevention? SMBs should track workflow adherence, user reporting, suspicious payment-change attempts, Defender for Office 365 detections, mailbox forwarding events, finance user MFA coverage, and exceptions to the vendor verification process. These metrics show whether invoice fraud risk is being reduced through both technology and behavior change.
Read full post on blog.sourcepass.com
Microsoft Copilot Cowork: A Look at Microsoft's Next Gen AI Agent
Artificial intelligence has evolved rapidly from simple chat interfaces to tools capable of performing increasingly complex business tasks. Microsoft is now taking the next step with Copilot Cowork, a new AI capability designed to move beyond answering questions and toward executing work.
Artificial intelligence has evolved rapidly from simple chat interfaces to tools capable of performing increasingly complex business tasks. Microsoft is now taking the next step with Copilot Cowork, a new AI capability designed to move beyond answering questions and toward executing work.
Read full post on blog.sourcepass.com
AI-Powered Cyber Threats and Water Utilities: What Public-Sector Leaders Need to Know
Water and wastewater organizations have long been considered part of the nation's critical infrastructure, but recent developments highlight how the threat landscape is evolving faster than many public-sector entities can adapt. New findings from both the U.S. Government Accountability Office (GAO) and industrial cybersecurity firm Dragos underscore a common message: water utilities must strengthen cybersecurity programs, improve visibility across operational technology (OT) environments, and prepare for increasingly sophisticated attacks. For utility leaders, these reports offer valuabl
Water and wastewater organizations have long been considered part of the nation's critical infrastructure, but recent developments highlight how the threat landscape is evolving faster than many public-sector entities can adapt. New findings from both the U.S. Government Accountability Office (GAO) and industrial cybersecurity firm Dragos underscore a common message: water utilities must strengthen cybersecurity programs, improve visibility across operational technology (OT) environments, and prepare for increasingly sophisticated attacks. For utility leaders, these reports offer valuable insight into both systemic cybersecurity challenges and emerging threats that could impact essential services. GAO Highlights Ongoing Cybersecurity Challenges for Water Systems In recent congressional testimony, the GAO warned that water and wastewater systems continue to face significant cybersecurity risks. According to the agency, several factors are contributing to a growing attack surface: Operational technology (OT) systems are becoming increasingly connected to enterprise networks and the internet. Aging infrastructure often lacks modern security controls. Workforce shortages make it difficult to maintain and secure critical systems. Cyber threats targeting critical infrastructure continue to increase in sophistication. While the testimony was not tied to a single cybersecurity incident, it reinforces concerns that many water utilities are managing complex operational environments with limited resources. As digital transformation initiatives continue, organizations must balance modernization efforts with cybersecurity resilience. For public-sector and utility leaders, the message is clear: cybersecurity can no longer be viewed solely as an IT concern. Protecting operational systems that support water treatment, distribution, and monitoring has become an essential component of business continuity and public safety. The First Public Example of AI-Assisted Targeting of Water Infrastructure A separate report from industrial cybersecurity firm Dragos provides one of the first publicly documented examples of an adversary using commercial artificial intelligence tools to support activities against a municipal water utility. According to Dragos, investigators analyzed an intrusion involving a municipal water and drainage utility where attackers attempted to move from a compromised enterprise IT environment toward operational technology systems. The significance of the incident is not that attackers successfully compromised operational systems—Dragos reported no evidence that OT systems were breached—but rather that AI tools were used to accelerate intrusion planning, environment mapping, reconnaissance, and identification of OT-adjacent assets. Their findings demonstrate how commercially available AI technologies can help threat actors: Analyze complex environments more quickly. Identify high-value infrastructure assets. Generate and refine attack pathways. Scale common offensive techniques with greater speed. According to Dragos, the incident illustrates how AI can make OT environments more visible to adversaries already operating within an organization's IT network. Why This Matters for Water Utilities Historically, specialized knowledge created a barrier between traditional cybercriminal activity and operational technology environments. Emerging AI capabilities may lower that barrier by helping attackers identify industrial systems and understand potential pathways between IT and OT networks. As a result, water utilities should evaluate whether existing cybersecurity programs adequately address both enterprise IT systems and operational environments. Areas that warrant attention include: IT and OT network segmentation Identity and access management controls Multi-factor authentication Remote access security Continuous monitoring and logging Incident response planning Asset inventory and visibility across critical systems Many of these practices are reflected in water-sector cybersecurity guidance and templates used to support utility cybersecurity programs. For example, water system cybersecurity frameworks emphasize secure remote access, monitoring network activity, maintaining asset inventories, managing OT access privileges, and regularly reviewing cybersecurity controls. Building Cyber Resilience in Critical Infrastructure While AI-assisted attacks are still emerging, the broader lesson is not necessarily about artificial intelligence itself—it's about preparedness. Threat actors continue to evolve their methods, and public-sector organizations must evolve their defenses accordingly. Strong cybersecurity fundamentals remain critical: visibility, access controls, network segmentation, monitoring, governance, and incident response planning continue to form the foundation of an effective security program. Water utilities that proactively address these areas will be better positioned to reduce risk, meet regulatory obligations, and maintain the reliability of the essential services their communities depend on. How Sourcepass GOV Helps Sourcepass GOV works with water districts, municipalities, and other public-sector organizations to strengthen cybersecurity programs through risk assessments, security advisory services, governance support, incident response planning, tabletop exercises, compliance oversight, and dedicated vCISO services. These services are designed to help organizations identify vulnerabilities, improve resilience, and build a practical roadmap for managing cyber risk. Learn More To read the full Dragos analysis, visit: AI in the Breach: How an Adversary Leveraged AI to Target a Water Utility Sources: Dragos, https://www.gao.gov/
Read full post on blog.sourcepass.com