Would You Even Know If an Employee's Password Got Stolen? Most business owners would say yes, of course. Someone would notice. IT would catch it.

Here's the uncomfortable truth: probably not, and probably not right away.

Office 365 Isn't Watching Itself

Office 365 comes packed with security and audit tools - sign-in logs, mailbox rule tracking, activity history. Microsoft has confirmed these tools exist and can capture detailed records of what's happening inside an account. But there's a catch: that data is largely restricted to a handful of IT-focused admin roles, and by default it's aggregated or masked rather than surfaced as an active alert.

In other words, the evidence is there. Nobody's watching it in real time.

For a company with a dedicated security team, that's a manageable gap. For a business running IT with one in-house person juggling password resets, printer jams, and a hundred other fires - it's a blind spot. Nobody's job is to sit and watch the logs. So nobody does.

What a Compromised Account Actually Looks Like

Attackers rarely announce themselves. Instead, there are quiet signals that something's wrong:

  • Sign-ins from unfamiliar locations or devices - a login from a country your employee has never been to
  • New mailbox rules that appear out of nowhere - often forwarding copies of every email to an external address the employee never set up
  • Emails you don't recognize in "Sent" or "Deleted" - evidence of activity the actual user never took
  • Signature changes - a subtle edit designed to make phishing replies look more convincing
  • A wave of failed login attempts - the digital equivalent of someone jiggling the doorknob

None of these trigger a phone call or a red banner unless something is actively looking for them. Without monitoring, the first sign of a problem is often a client asking why they got a strange invoice from your company, or your bank flagging a wire transfer nobody remembers approving.

Why This Matters More Than It Used To

This isn't a hypothetical risk. Business email compromise - attackers using a hijacked or spoofed email account to redirect payments or steal sensitive data - is now one of the most expensive categories of cybercrime in the country. In 2025, BEC generated $3.046 billion in reported losses in the U.S., making it the second-highest loss category behind investment fraud. The average loss per incident has climbed to $137,000, up 83% from $74,723 in 2019 - meaning fewer companies are getting hit, but the ones that are get hit a lot harder.

And it doesn't take a sophisticated hack. Often it just takes one stolen password and nobody checking the sign-in logs for three weeks.

The Fix Isn't Complicated - It's Just Not Automatic

Enabling multi-factor authentication is step one, and most businesses have gotten there. But MFA doesn't monitor mailbox rules, flag impossible-travel logins, or catch a forwarding rule quietly siphoning off every invoice that comes through finance. That takes someone - or something - actively watching.

That's the difference between having Office 365 and having Office 365 *monitored*. The tools to catch a compromise early already exist inside your environment. The question is whether anyone's assigned to use them.

If you're not sure who's watching your Office 365 environment - or if the honest answer is "no one" - that's a conversation worth having before it becomes an incident. Red Key helps internal IT teams add exactly this kind of coverage without replacing the people who already know your business.*