Insights — IT & Security

Plain answers on cybersecurity and the Microsoft cloud

Practical, jargon-free guidance on cybersecurity, Zero Trust, Microsoft 365 and Azure, licensing and cloud modernisation.

Microsoft & CloudCostAI SecurityCybersecurity
Microsoft 365 E7 explained: what the Frontier Suite includes and who should buy it
Microsoft's first new enterprise tier since E5 bundles Copilot, the Entra Suite and Agent 365 at $99 per user. What you actually get, what it replaces, and the honest test of whether it is worth it.
25 July 2026Read
Microsoft & CloudCybersecurityCost
Business Premium vs Microsoft 365 E3 vs E5 vs E7: a security-first licensing guide
What each Microsoft 365 tier actually includes for security after the July 2026 packaging update, where the real gaps are, and the mixed-licensing strategy most advisors don't mention.
24 July 2026Read
CybersecurityMicrosoft & Cloud
CIS Microsoft 365 Foundations Benchmark: profiles, levels and Implementation Groups explained
The CIS M365 benchmark turns tenant hardening into an auditable control set — how Level 1/2 profiles work, how Implementation Groups map onto them, and how to use both without drowning in controls.
24 July 2026Read
Microsoft & CloudCostCybersecurity
Microsoft 365 price and packaging changes, July 2026: what changed and what to do
Prices rose across most Microsoft 365 suites on 1 July 2026, and the update quietly added security capability to E3 and E5: the numbers, what you already own, and how to handle renewal.
24 July 2026Read
Microsoft & CloudCybersecurity
Conditional Access: the baseline policies every tenant needs (and the misconfigurations we keep finding)
The Conditional Access policy set we deploy in every engagement, the design principles behind it, and the five misconfigurations that appear in almost every tenant we assess.
23 July 2026Read
AI SecurityCertificationCybersecurity
ISO 42001 explained: the first AI management system standard, and who actually needs it
ISO/IEC 42001 is the first certifiable management system standard for AI. What it requires, who is asking for it in 2026, and how it fits alongside ISO 27001.
23 July 2026Read
Microsoft & CloudCybersecurity
Microsoft 365 security best practices: the 2026 hardening checklist for every licence tier
The tenant hardening steps that matter most in 2026, organised by what your licence already includes — Business Premium, E3 or E5. Most tenants use a fraction of what they pay for.
23 July 2026Read
Microsoft & CloudCybersecurity
What is Microsoft Secure Score — and what does 'good' actually look like?
Secure Score is the most useful single number in Microsoft 365 security, and the most misread. What it measures, what it misses, and realistic targets by licence tier.
23 July 2026Read
Microsoft & Cloud
Tenant-to-tenant migration after a merger: the complete M&A checklist
Microsoft 365 tenant consolidation is the highest-stakes project in the Modern Workplace. The full checklist (identity, data, coexistence, cutover) from a practice that runs these migrations.
23 July 2026Read
AI SecurityCybersecurityCertification
Already ISO 27001 certified? You're roughly 40% of the way to ISO 42001 — here's the rest
Your ISMS gives ISO 42001 its management-system spine. What carries over, what is genuinely new build — AI inventory, impact assessment, lifecycle controls — and the integration route.
22 July 2026Read
CybersecurityMicrosoft & Cloud
Phishing-resistant MFA: why standard MFA no longer stops AiTM attacks
Adversary-in-the-middle kits steal authenticated sessions straight through approve-button MFA. How the attack works, and the controls that break it: passkeys, token protection, compliant devices.
22 July 2026Read
CybersecurityMicrosoft & Cloud
Zero Trust in practice: implementing NIST 800-207 with the Microsoft stack
Zero Trust is an architecture, not a product. How NIST 800-207's principles map onto Entra, Intune, Defender and Purview, and the implementation sequence that works.
22 July 2026Read
CybersecurityMicrosoft & Cloud
Business email compromise: anatomy of the attack and the controls that break it
BEC quietly costs organisations more than ransomware. How the attack works (no malware required) and the technical and human controls that stop the fraudulent payment before it leaves.
21 July 2026Read
CybersecurityMicrosoft & Cloud
Exchange hybrid: why CISA wants your hybrid config hardened, and how to do it
Exchange hybrid deployments expanded the attack surface and CISA has issued urgent guidance. The risks, the CVE-2025-53786 shared-identity issue, and the hardening steps that close them.
21 July 2026Read
Microsoft & Cloud
Intune vs SCCM in 2026: when co-management ends and cloud-native begins
The Intune-versus-SCCM question is really a migration-sequencing question. What each does well, how co-management bridges them, and how to decide when to go cloud-native.
21 July 2026Read
CybersecurityAuditingCertification
ISO 27001:2022 audit findings: the nonconformities security teams miss most
Technical teams build strong controls and still fail ISO 27001 audits — on the management-system clauses, not the technology. The findings that recur, and how to close them.
21 July 2026Read
CybersecurityMicrosoft & CloudCost
Microsoft Sentinel on a budget: SIEM design choices that control ingestion costs
Sentinel's power is real and so is its bill. The design decisions — table tiers, data collection rules, connector discipline — that keep a cloud-native SOC affordable without going blind.
21 July 2026Read
CybersecurityMicrosoft & Cloud
Ransomware defence with what you already own: Microsoft-native controls that work
Most organisations buy ransomware protection they already have and never configured. The Microsoft-native control set that breaks the ransomware kill chain, mapped stage by stage.
21 July 2026Read
Microsoft & CloudCybersecurity
Microsoft Teams governance: stopping sprawl before it becomes a security problem
Ungoverned Teams becomes a data-sprawl and security liability within a year. The governance model (lifecycle, guest access, sensitivity labels) that keeps collaboration usable and safe.
21 July 2026Read

Let's build your certification roadmap

Book a short discovery call to talk through your current systems, sector and target standards. We'll come back with clear, practical next steps.

Book a consultation or email inquiries@qg-pro.com

Plain answers on cybersecurity and the Microsoft cloud

Microsoft 365 E7 explained: what the Frontier Suite includes and who should buy it

Business Premium vs Microsoft 365 E3 vs E5 vs E7: a security-first licensing guide

CIS Microsoft 365 Foundations Benchmark: profiles, levels and Implementation Groups explained

Microsoft 365 price and packaging changes, July 2026: what changed and what to do

Conditional Access: the baseline policies every tenant needs (and the misconfigurations we keep finding)

ISO 42001 explained: the first AI management system standard, and who actually needs it

Microsoft 365 security best practices: the 2026 hardening checklist for every licence tier

What is Microsoft Secure Score — and what does 'good' actually look like?

Tenant-to-tenant migration after a merger: the complete M&A checklist

Already ISO 27001 certified? You're roughly 40% of the way to ISO 42001 — here's the rest

Phishing-resistant MFA: why standard MFA no longer stops AiTM attacks

Zero Trust in practice: implementing NIST 800-207 with the Microsoft stack

Business email compromise: anatomy of the attack and the controls that break it

Exchange hybrid: why CISA wants your hybrid config hardened, and how to do it

Intune vs SCCM in 2026: when co-management ends and cloud-native begins

ISO 27001:2022 audit findings: the nonconformities security teams miss most

Microsoft Sentinel on a budget: SIEM design choices that control ingestion costs

Ransomware defence with what you already own: Microsoft-native controls that work

Microsoft Teams governance: stopping sprawl before it becomes a security problem

Let's build your certification roadmap