The Evolution of Email Threats
⚠️ Technical Deep Dive: This post contains detailed technical implementation guidance for IT teams. If you’re a municipal executive looking for strategic overview, consider sharing this with your IT director or security team for implementation.
In our email security series, we’ve covered how municipalities aren’t using their M365 security features effectively and how proper authentication provides the foundation for advanced protection. Now we need to address the sophisticated threats that require more than basic filtering to stop.
Today’s email attacks aren’t the spam and obvious phishing attempts that traditional filters were designed to catch. We’re facing AI-enhanced attacks, zero-day exploits, and behavioural manipulation techniques that require advanced threat protection capabilities.
The good news? Your M365 Business Premium subscription includes enterprise-grade advanced threat protection. The challenge? Most municipalities are barely scratching the surface of these capabilities.
Beyond Signature-Based Detection
Traditional email security relies on known threat signatures—patterns and hashes of previously identified malicious content. This approach fails against modern threats because:
Zero-Day Exploits: New vulnerabilities that haven’t been catalogued yet AI-Generated Content: Machine-learning created phishing emails that bypass pattern matching Living-Off-the-Land Attacks: Using legitimate tools and processes maliciously Behavioural Manipulation: Social engineering that doesn’t rely on malicious code
Municipal networks are particularly vulnerable to these attacks. Attackers know that public sector IT teams often rely on default security configurations. These defaults prioritize compatibility over protection.
M365 Advanced Threat Protection Deep Dive
Your M365 Business Premium subscription includes several advanced protection mechanisms that go far beyond basic filtering:
Safe Attachments: Cloud-Based Sandboxing
How It Works: Safe Attachments doesn’t just scan files against known malware signatures. It uses sandboxing—isolating suspicious files in a protected virtual environment to observe their behaviour without risking your network. Attachments are executed in Microsoft’s cloud-based sandbox, detecting malicious activity before files reach users.
Advanced Capabilities:
Dynamic Analysis: Dynamic analysis tests how files actually behave when executed, unlike static scanning that only examines file characteristics. Files are executed in virtual environments that mimic your actual systems, revealing malicious behaviour that static scanning would miss.
Zero-Day Protection: Can identify previously unknown threats by analyzing what the file actually does, not just what it looks like.
Multiple Environment Testing: Suspicious files are tested across different operating systems and application versions to catch environment-specific exploits.
Time-Delayed Detonation: Some malware waits before activating—Safe Attachments can detect these time-delayed threats.
Municipal Configuration Recommendations:
Safe Attachments Policy Configuration:
- Response: Block (not Monitor)
- Redirect Attachment: Yes (to security team)
- Apply if scanning fails: Yes (err on the side of caution)
- Track user clicks: Yes (for threat intelligence)
Safe Links: Real-Time URL Analysis
Beyond Basic URL Filtering: Safe Links doesn’t just check URLs against blacklists. It performs real-time analysis every time a user clicks a link, even if the site became malicious after the email was delivered.
Advanced Protection Features:
Time-of-Click Scanning: URLs are scanned when users actually click them, not just when emails are received. This catches sites that become malicious after initial delivery.
Reputation Analysis: Uses Microsoft’s global threat intelligence to assess the reputation of domains, even if they’re not explicitly blocked.
Safe Documents Integration: When Safe Links detects a potentially dangerous file download, it can trigger Safe Documents for additional analysis.
Behavioural Heuristics: Behavioural heuristics analyze user click patterns to detect suspicious activity. For example, the system flags rapid clicking through multiple security warnings as potentially risky behaviour.
Municipal Implementation Strategy:
Safe Links Policy Configuration:
- Action for unknown or suspicious URLs: Block
- Apply real-time URL scanning: Yes
- Apply to email messages: Yes
- Apply to Microsoft Teams: Yes
- Apply to Office applications: Yes
- Do not track user clicks: No (tracking provides valuable intelligence)
- Do not let users click through to original URL: Yes for high-risk users
Anti-Phishing: Executive and Domain Protection
Advanced Impersonation Detection: M365’s anti-phishing goes beyond simple domain spoofing to detect sophisticated impersonation attempts.
Mailbox Intelligence: This feature learns your organisation’s communication patterns over time. It uses this learning to detect when someone is impersonating internal users based on unusual communication behaviours.
Domain Impersonation: Protects against look-alike domains that are similar to your municipality’s domain or trusted partner domains.
User Impersonation: Specifically protects high-value targets like mayors, city managers, and finance directors.
Spoof Intelligence: Spoofing is email forgery that makes messages appear to come from your domain when they don’t. Spoof intelligence uses machine learning to identify these forged emails and block them.
Municipal Anti-Phishing Configuration:
Anti-Phishing Policy Settings:
- Enable mailbox intelligence: Yes
- Enable intelligence for impersonation protection: Yes
- Add users to protect: [Mayor, City Manager, Finance Director, IT Director]
- Add domains to protect: [Your domain, partner municipalities, key vendors]
- Actions: Quarantine (for investigation)
- Safety tips: Show for impersonation (warn users)
Advanced Analytics and Threat Intelligence
Attack Simulation Training
Note on Licensing: Attack Simulation Training requires Microsoft Defender for Office 365 Plan 2, which is not included in M365 Business Premium. Municipalities can access this capability through the Microsoft Defender Suite add-on (announced September 2025) or by upgrading to Microsoft 365 E5. For municipalities using Business Premium, third-party phishing simulation services can provide similar capabilities while you evaluate upgrade options.
For municipalities with Plan 2 licensing, built-in phishing simulation capabilities help train staff while providing valuable intelligence about your organization’s vulnerabilities.
Simulation Capabilities:
- Credential harvest simulations
- Malware attachment simulations
- Link-in-attachment simulations
- Drive-by URL simulations
Municipal Training Strategy:
- Start with low-complexity simulations
- Focus on municipal-specific scenarios (vendor impersonation, emergency notifications)
- Use failed simulation data to identify high-risk users for additional training
- Integrate results with your broader cybersecurity awareness program
Real-Time Detections and Threat Intelligence
M365 Business Premium includes Real-Time Detections (Defender for Office 365 Plan 1 feature). This provides insight into your organisation’s threat landscape at email delivery time.
Available Intelligence in Real-Time Detections:
- Email threat trends in your organization
- Top targeted users
- Attack vectors being used against your municipality at delivery
- Effectiveness of your current security policies
Municipal Use Cases:
- Identify departments receiving the most targeted attacks
- Track seasonal attack patterns (budget season, election periods)
- Monitor for attacks targeting specific municipal processes
- Validate security policy effectiveness
Upgrade Path: Larger municipalities requiring post-delivery activity tracking and advanced threat hunting can upgrade to Threat Explorer (Defender for Office 365 Plan 2) through the Microsoft Defender Suite add-on or Microsoft 365 E5 licensing. Threat Explorer adds capabilities like post-delivery remediation tracking, advanced hunting queries, and 30-day threat history analysis.
Integration with Municipal Infrastructure
Microsoft Sentinel Integration
For larger municipalities, M365 Defender can integrate with Microsoft Sentinel. This provides security information and event management (SIEM) capabilities. SIEM platforms collect and analyze security data from multiple sources to detect threats across your entire infrastructure. Understanding the [[Published/Blog/2025-09-24 Shared Responsibility and FOIPPA - Blog|shared responsibility model for FOIPPA compliance]] helps determine which advanced features your municipality should prioritize.
Note on Requirements: Sentinel integration requires Defender for Office 365 Plan 2 (or higher) plus separate Microsoft Sentinel licensing. This advanced capability is typically cost-effective for municipalities with 500+ users or those managing multiple security data sources. Smaller municipalities should focus on maximizing the built-in Microsoft 365 Defender portal reporting before considering Sentinel investment.
Advanced Correlation:
- Connect email threats to broader attack patterns
- Identify multi-vector attacks that start with email
- Automate response workflows for detected threats
PowerBI Reporting
Municipalities with PowerBI expertise can create custom dashboards. These show leadership the effectiveness of email security investments using Microsoft Defender APIs.
Executive Dashboards:
- Threats blocked vs. threats that would have reached users
- ROI of advanced threat protection features
- Comparison with other municipalities (anonymized industry data)
Operational Dashboards:
- Real-time threat detection status
- User behaviour trends and training needs
- Security policy effectiveness metrics
Implementation Note: PowerBI dashboard creation requires PowerBI Pro licensing and data visualization expertise. Most municipalities with 2-10 person IT teams should start with the built-in reporting in the Microsoft 365 Defender portal, which provides comprehensive threat intelligence without additional development effort. Consider PowerBI integration once you’ve maximized the value of built-in reporting capabilities.
Advanced Configuration Strategies
Conditional Access Integration
Conditional Access controls who can access what resources based on conditions like location, device security, or user behaviour. You can link email security events with these broader access control policies:
High-Risk User Identification:
- Users who fail multiple phishing simulations get additional MFA requirements
- Users who click through multiple Safe Links warnings face access restrictions
- Automated escalation to security team for repeated high-risk behaviour
These conditional access policies integrate with the [[Published/Blog/2025-11-28 Real-Time Device Monitoring Moving Beyond Quarterly IT Audits - Blog|continuous monitoring capabilities already included in M365 Business Premium]].
Custom Detection Rules
For municipalities with specific threat concerns, you can create custom detection rules. Indicators of Compromise are evidence that an attack may have occurred or be in progress.
Custom Indicators of Compromise:
- Keywords specific to municipal operations (budget, tax, council, emergency)
- Attachment types commonly used in municipal workflows
- Sender patterns that might indicate targeting
Measuring Advanced Protection Effectiveness
Key Performance Indicators
Protection Metrics:
- Advanced threats blocked by Safe Attachments (target: track trend over time)
- Malicious URLs blocked by Safe Links (target: >95% of known threats)
- Impersonation attempts blocked by anti-phishing (target: 100% of configured protections)
User Behavior Metrics:
- Phishing simulation failure rate (target: <10% for trained users)
- Safe Links click-through warnings (target: decreasing over time)
- Security alert reporting by users (target: increasing awareness)
Business Impact Metrics:
- Incident response costs avoided
- Productivity impact from false positives (target: <1% of processed email)
- User satisfaction with security measures
Municipal-Specific Advanced Threat Scenarios
Business Email Compromise Targeting Municipalities
Business email compromise (BEC) attacks account for 73% of cyber incidents. Government entities are experiencing a 20% rise in targeting. Municipalities are particularly vulnerable to BEC schemes due to several factors that attackers systematically exploit.
Public Information Exposure: Staff names, titles, email addresses, and organizational charts are readily available online through municipal websites and public records. Attackers research this information to craft convincing impersonation attacks targeting finance staff, procurement officers, and executive leadership.
Vendor Relationship Complexity: Multiple departments managing their own vendor relationships create numerous legitimate payment workflows. A single digit change in a routing number can redirect payments worth thousands. Some attacks redirect hundreds of thousands to attacker-controlled accounts.
Budget Approval Processes: Predictable financial cycles create opportunities for wire transfer fraud. Attackers time their attacks to coincide with fiscal year-end pressures, capital project funding, or emergency procurement situations when finance teams are under time pressure.
Enhanced BEC Protection with Microsoft Defender:
- Configure anti-phishing policies to specifically protect finance directors, mayors, city managers, and procurement officers from impersonation attacks
- Enable mailbox intelligence to detect communication pattern anomalies—if your mayor has never requested wire transfers via email before, the system flags this as suspicious
- Implement domain impersonation protection for your municipality and key vendors to detect look-alike domains (e.g., cityvancouver.ca vs cityvancouver.co)
- Use Safe Links protection to block credential harvest attempts that enable BEC attacks by compromising legitimate accounts
- Review Real-Time Detections regularly for attempted impersonation attacks to understand how your municipality is being targeted
The average BEC loss is $137,132—more than the annual software budget for most small municipalities. Advanced threat protection isn’t just about preventing nuisance phishing; it’s about preventing financial catastrophe.
Budget Season Targeting
Municipal budget processes create predictable attack opportunities:
Enhanced Protection During Budget Cycles:
- Increase phishing simulation frequency
- Add budget-related keywords to custom detection rules
- Implement additional scrutiny for financial process emails
- Brief finance staff on increased threat levels
Election Period Security
Municipal elections create unique threat profiles:
Election-Specific Protections:
- Monitor for election-related phishing attempts
- Protect election officials with enhanced anti-phishing policies
- Watch for disinformation campaigns via email
- Coordinate with provincial/federal election security guidelines
Emergency Response Coordination
Email plays a critical role in municipal emergency response:
Emergency Communications Security:
- Ensure Safe Links doesn’t interfere with emergency communication speed
- Pre-authorize emergency communication domains
- Implement separate policies for emergency response teams
- Plan for security policy adjustments during declared emergencies
Implementation Roadmap
This phased implementation requires approximately 2-4 hours per week from your email administrator or security lead. The 8-week timeline is designed for municipal IT teams managing multiple responsibilities. This allows security improvements without disrupting daily operations.
Phase 1: Foundation (Weeks 1-2, ~4-6 hours total)
- Enable Safe Attachments in Block mode
- Configure Safe Links for real-time protection
- Set up basic anti-phishing policies for executives
For detailed configuration steps, reference Microsoft’s official Defender for Office 365 deployment guide.
Phase 2: Enhancement (Weeks 3-4, ~4-6 hours total)
- Configure advanced anti-phishing for domain protection
- Set up threat monitoring and reporting using Real-Time Detections
- (Optional) Implement attack simulation training program (requires Plan 2 upgrade or third-party phishing simulation service)
Phase 3: Optimization (Weeks 5-8)
- Analyze threat intelligence data for municipal-specific patterns
- Fine-tune policies based on false positive/negative rates
- Integrate with broader municipal security infrastructure
Phase 4: Advanced Integration (Ongoing)
- Implement conditional access based on threat intelligence
- Develop custom detection rules for municipal scenarios
- Create executive reporting and ROI analysis
Common Implementation Pitfalls
Over-Aggressive Initial Configuration
Problem: Implementing maximum security settings immediately Solution: Gradual rollout with monitoring and adjustment periods
Insufficient User Training
Problem: Advanced security without user education leads to circumvention Solution: Comprehensive training program that explains new security measures
Ignoring False Positives
Problem: Legitimate municipal business being blocked by security policies Solution: Regular review and adjustment based on operational impact
Lack of Threat Intelligence Analysis
Problem: Collecting security data without analyzing patterns Solution: Regular review of threat trends and policy effectiveness
The Advanced Protection Advantage
Advanced threat protection isn’t about having the most sophisticated technology—it’s about using the sophisticated technology you already have to its full potential.
For municipalities, advanced email protection provides:
Proactive Defense: Stop threats before they reach users, not just detect them after damage is done
Behavioural Intelligence: Understand how your organisation is being targeted and adjust defences accordingly
User Empowerment: Give staff the tools and knowledge to recognize and report threats effectively
Executive Confidence: Provide leadership with data-driven assurance that email security investments are working
FOIPPA Compliance Support: For BC municipalities, advanced threat protection directly supports Freedom of Information and Protection of Privacy Act obligations.
Anti-phishing policies prevent domain spoofing. Safe Links blocks business email compromise attacks before they reach users. These controls help municipalities meet their duty to implement “reasonable security arrangements” for personal information protection.
U.S. federal agencies use CISA’s Secure Cloud Business Applications (SCuBA) baseline as their Defender for Office 365 configuration standard. Canadian municipalities can use these same baselines to demonstrate reasonable security arrangements for FOIPPA compliance.
Combined with [[Published/Blog/2025-09-22 FOIPPA Compliance Gap in M365 - Blog|M365 retention policies that preserve records]], advanced threat protection creates comprehensive privacy protection.
Documentation of your Safe Attachments, Safe Links, and anti-phishing configurations provides evidence of due diligence. This supports privacy compliance audits and demonstrates breach prevention efforts.
The Bottom Line
Basic email filtering was adequate when threats were basic. Today’s AI-enhanced, behaviourally-sophisticated attacks require advanced protection mechanisms that analyse not just what threats look like, but what they actually do.
Your M365 Business Premium subscription includes enterprise-grade advanced threat protection. The question isn’t whether you can afford to implement these capabilities—it’s whether you can afford not to.
Modern email threats require modern email defenses. Safe Attachments, Safe Links, and advanced anti-phishing aren’t just features—they’re essential components of municipal cybersecurity that protect not just your email, but your entire digital infrastructure.
The attacks targeting your municipality are professional and sophisticated. Your email security should be too.
Don’t let advanced threats find basic defenses. Implement the advanced protection capabilities you’re already paying for, and give your municipality the email security it needs to operate safely in today’s threat environment.
Your First Steps This Week
Don’t wait for the next phishing incident to expose gaps in your email security. Start strengthening your defenses today:
Monday Morning (30 minutes):
- Log into the Microsoft 365 Defender portal at security.microsoft.com
- Navigate to Email & Collaboration > Policies & Rules > Threat Policies
- Review which Safe Attachments, Safe Links, and anti-phishing policies are currently active
- Check if you’re using Built-in, Standard, or Strict preset security policies
This Week (2-3 hours):
- Enable Safe Attachments in Block mode if not already configured
- Configure Safe Links for real-time URL scanning in email and Microsoft Teams
- Create anti-phishing policies protecting your mayor, city manager, and finance director
- Review Real-Time Detections to understand current threat patterns targeting your municipality
This Month (4-6 hours):
- Implement the Phase 1 recommendations from the implementation roadmap above
- Schedule 30 minutes weekly to review threat detection data
- Document your configurations for FOIPPA compliance audit trails
- Brief your team on what changed and why it matters
The gap between what you’re paying for and what you’re using could be costing your municipality more than just subscription fees. Close that gap starting today.