How to Strengthen Microsoft 365 Before Attackers, Insurers, or AI Expose the Gaps

Here is a familiar situation. A business has Microsoft 365, a cyber-insurance renewal coming up, a few remote employees, and leadership asking whether Copilot or another AI tool should be part of next year’s plan. Nothing looks broken. Email works. Teams works. Files are moving. People are productive.

Then someone asks three simple questions:

That is usually the moment Microsoft 365 security changes from an IT checklist into a business issue. Attackers care about weak identity and unmanaged devices. Insurers care about whether foundational controls are actually deployed. AI cares about permissions and data access because it can only work with what your environment allows it to see.

That is the point of the Covenant Fortify framework. It separates the security controls every organization should confirm from the deeper protections that become important based on your environment, risk, and business plans.

The foundation we expect: F1 and F2.

Some controls are no longer optional. They are the floor. When we look at a client environment, F1 and F2 are the two stages we believe should already be in place. If they are not, they are the first things we close.

F1: People

Most incidents start with a person, not a firewall. An attacker does not break in so much as sign in, using a password that leaked, a convincing phishing email, or an account with more access than it needs.

In the real-world scenario above, F1 answers the cyber-insurance and breach-prevention question first: are the right identity controls actually in place? That means multi-factor authentication, phishing defense, and access controls that make sure people can only reach what their role requires.

F2: Devices

Your people work from laptops in the office, at home, and everywhere in between. Every one of those devices is a door. An unmanaged or unmonitored endpoint can turn a single mistake into a business-wide problem.

F2 is where the organization stops assuming every laptop is safe simply because the user is trusted. It secures endpoints through consistent configuration, monitoring, and management whether a device sits at a desk or moves between locations.

Where Fortify goes next: F3 and F4.

F3 and F4 are added based on business needs, not sold by default. They matter when your organization holds sensitive information, has compliance pressure, or is getting ready to put AI to work.

F3: Data

If you handle client records, contracts, financial data, health information, or anything you would not want walking out the door, F3 is where that risk gets addressed.

Think about a folder that was shared broadly during a project and never locked back down. Or a departing employee who still has access to records they no longer need. Or a department that stores sensitive files in a place nobody has reviewed in years. F3 brings encryption, retention rules, access controls, and data loss prevention to the information that matters most.

It turns “we think it is fine” into “we know who can see what, and we can prove it.”

F4: AI readiness

AI is the fastest way to discover how much your data was overshared. Copilot works inside your Microsoft 365 environment. It uses your data, respects your permissions, and surfaces whatever a user is technically allowed to see.

That is helpful when permissions are clean. It is risky when access has quietly drifted over the years. F4 closes those gaps before AI amplifies them, so the productivity win arrives without avoidable exposure.