Topic: blog posts

With Cybercriminals Moving Faster Than Ever, Businesses  Must Act Quickly To Stay Ahead Of Evolving Threats.

Not only are cybercriminals getting smarter – they’re getting faster. The 2025 Annual SonicWall Cyber Threat Report is available now, and it’s uncovered an unsettling reality: hackers are now using public exploit code within 48 hours of release. Making matters worse is how long it takes organisations to patch critical security flaws.

For businesses and security professionals, this means the window for prevention is shrinking rapidly. Legacy security solutions are no longer enough, businesses must adopt a new mindset to combat modern cyber threats. To stay ahead, businesses need real-time threat intelligence, continuous monitoring and proactive defence strategies.

48 Hours, Meet 3,600 Hours

SonicWall’s data shows that 61% of the time, threat actors are utilising publicly available exploit codes in as little as 48 hours. When you compare that to the 120 to 150 days it takes organisations
to implement patches on average, it starts to paint a frightening picture. That 3,552-hour gap is where the most damage happens – data theft, ransomware, business email compromise (BEC) and
more.

We have some examples, too. In 2024, the LockBit ransomware group exploited a critical JetBrains TeamCity vulnerability (CVE-2024-27198), launching attacks within 24 hours of its disclosure.
Meanwhile, Cl0p ransomware operators used a different critical flaw to breach 66 companies within two days of a PoC release. These aren’t isolated incidents—they’re part of an alarming trend where attackers weaponize vulnerabilities before businesses even know they exist.

Ransomware And BEC: Bigger, Faster And More Costly

Ransomware continues to be a devastating cyber threat, and our threat report shows why. In 2024 alone, ransomware cost businesses an average of $4.91 million per incident when you factor in
downtime, data recovery and ransom payments. And it’s not just ransomware – BEC attacks have surged to account for one-third of all reported cyber insurance claims, as shared with us through our trusted cyber insurance partner, Cysurance. These attacks are becoming more sophisticated, often using AI to craft convincing phishing emails that trick employees into sending money or sensitive data to cybercriminals. With cyber insurance costs skyrocketing, businesses need to double down on prevention rather than waiting to be attacked and spending even more on recovery.

IoT And Cloud Threats Are Escalating

With more connected devices than ever, IoT attacks have spiked by 124%, making unsecured devices an easy entry point for cybercriminals. Meanwhile, cloud-based threats remain a top
concern, with 85% of all actionable security alerts tied to cloud account compromises. As businesses continue their digital transformations, securing IoT devices and cloud environments
must be a top priority.

How Businesses Can Stay Ahead

The speed at which threat actors move today demands an always-on approach to cybersecurity. Here’s what organisations can do right now:

• Reduce the Patching Gap: Implement automated patch management and vulnerability scanning
  to stay ahead of known exploits.
• Leverage 24/7 Threat Monitoring: SonicWall’s SOC services ensure real-time detection and
  response, preventing breaches before they happen.
• Adopt Zero-Trust Security Models: Assume that no one – inside or outside the network –
  should be trusted by default. Strict access controls and continuous monitoring are key.
• Educate Employees on Phishing and BEC Threats: Human error remains a major factor in
  breaches, making security awareness training essential.

The full 2025 SonicWall Cyber Threat Report offers deeper insights into the modern threat landscape as well as details for staying ahead of emerging threats. With cybercriminals operating at
breakneck speeds, businesses can’t afford to play catch-up. The time to act is now.

Get the full report and see the latest cybersecurity trends first-hand.

User Account Hijacking in Microsoft 365

Microsoft 365 has become the backbone of modern businesses, enabling seamless collaboration, productivity, and cloud-based operations. However, as more organisations rely on this powerful platform, cybercriminals are finding new ways to exploit it. One of the most pressing threats today is user account hijacking, where attackers gain unauthorised access to Microsoft 365 accounts, leading to data breaches, financial loss, and operational disruption.

At Leaf IT, we understand that securing your Microsoft 365 environment requires more than just strong passwords. It demands proactive monitoring, intelligent threat detection, and rapid response. That’s why we’ve partnered with ConnectWise to deliver Managed Detection and Response (MDR), an advanced security solution designed to prevent account takeovers before they happen.

The Problem: User Account Hijacking on the Rise

Cybercriminals use advanced methods like phishing, brute force attacks, and token theft to hijack user accounts. Once they gain access, they can impersonate employees, alter financial transactions, and steal sensitive information (all without triggering typical security alerts).

With over 300 million daily active users on Microsoft 365, attackers have a vast attack surface to exploit. Alarmingly, over 80% of breaches involve compromised credentials, making account hijacking a significant concern for businesses of all sizes.

Growing Concerns Around Microsoft 365 Security

The U.S. Cyber Safety Review Board (CSRB) has raised serious concerns about Microsoft’s ability to protect Microsoft 365 inboxes from risky emails. A 2023 investigation revealed that hackers successfully infiltrated M365 email accounts of senior U.S. government officials, exploiting lapses in Microsoft’s security infrastructure.

The CSRB determined that this breach was preventable and criticised Microsoft’s security culture as “inadequate,” calling for a significant overhaul to better safeguard against such threats. This highlights the urgency for businesses to take proactive steps in securing their Microsoft 365 environments rather than relying solely on built-in protections.

The Solution: ConnectWise MDR – Advanced Security for Microsoft 365

ConnectWise MDR, provided by Leaf IT, offers 24/7 protection, intelligent threat detection, and rapid response to keep Microsoft 365 accounts safe from unauthorised access.

How MDR Protects Against Account Hijacking:

• Continuous Monitoring: The Security Operations Centre (SOC) monitors suspicious logins, unusual activity, and unauthorised access around the clock.
• Smart Threat Detection: Using advanced technology, MDR detects unusual behaviours that could indicate a compromised account before an attack escalates.
• Instant Response & Isolation: If an unauthorised login is detected, MDR can quickly lock down the account to prevent further damage.
• Multi-Factor Authentication (MFA) Enforcement: Ensures critical security measures like MFA and access controls are properly implemented and enforced.
• Compliance & Data Protection: Helps businesses meet essential privacy and security regulations by safeguarding Microsoft 365 accounts.

Why Choose Leaf IT?

As an award-winning Managed Service Provider, Leaf IT is a trusted cybersecurity partner dedicated to protecting businesses from modern threats. With over 22 years of expertise in Microsoft 365 security, cloud protection, and managed IT services, we provide tailored security solutions that keep your organisation safe.

Whether you need real-time threat monitoring, security audits, or user awareness training, Leaf IT ensures your Microsoft 365 environment remains resilient against attacks.

Don’t Wait Until It’s Too Late

Account hijacking can happen in seconds, but with Leaf IT and ConnectWise MDR, you can stop attackers before they gain control.

Contact Leaf IT today:

• Email: hello@leaf-it.com
• Call: 028 9089 7650
• Visit: leaf-it.com

It’s the most wonderful time of the year (for hackers!).

The festive season is a time for giving and celebration, but it’s also a prime opportunity for cybercriminals to strike. From gift voucher scams to data theft, the risks are real. As a business leader or IT decision-maker, taking proactive steps to protect your business is crucial to ensure your team can enjoy the holidays without worrying about cybersecurity threats.

Why Cybersecurity Scammers Target the Festive Season

Gift vouchers are a popular choice during the holidays, accounting for nearly 40% of annual sales. This makes them an attractive target for scammers. A common tactic is posing as a senior executive, such as the MD or CEO, to request voucher purchases. Scammers then use email exchanges to trick employees into sharing the codes, which are either resold or used directly.

How to Stay Ahead of Cyber Scammers:

• Email Filtering: Use a strong email filtering system to scan, score, and block suspicious emails before they reach your team’s inboxes.
• Staff Training: Regularly educate your team on how to spot phishing attempts. Make sure they feel confident in questioning unusual requests.

Protecting Your Business from Data Theft

Data is one of the most valuable assets a business holds, making it a prime target for hackers. Cybercriminals may attempt to breach your security to encrypt sensitive data and demand a ransom for its release. These ransomware attacks can be devastating, with financial losses, reputational damage, and potential fines from regulators if security measures are found lacking.

Key Cybersecurity Defences:

• Firewalls: A well-configured firewall acts as your first line of defence, safeguarding your network and critical services such as CCTV and remote access.
• Cloud Edge Security: Go beyond traditional firewalls with cloud edge security to protect your team no matter where they work—in the office, at home, or on the go.

Myth Buster: “Cloud Email Is Fully Secure”

Cloud platforms like Office 365 come with built-in security, but they’re not immune to threats. Cybercriminals are constantly evolving their tactics, so relying on basic protections like strong passwords is no longer enough.

Steps to Strengthen Cloud Security:

• Multifactor Authentication (MFA): Add an extra layer of security by requiring multiple forms of verification for account access.
• Managed Detection and Response (MDR): Partner with experts who monitor your cloud environment for threats. A Security Operations Centre (SOC) can quickly identify and respond to suspicious activity, minimising potential damage.

MDR in Action:

• Impossible Travel Alerts: Get notified if an account is accessed from two locations that are geographically impossible to travel between in a short time.
• Quick Response to Compromises: If an account is breached, SOC teams can block access, reset passwords, and stop malicious emails from reaching your contacts.

Keep the Festive Spirit Secure

The festive season should be a time to celebrate, not stress about cybersecurity. By implementing robust defences like email filtering, staff training, and advanced cloud security measures, you can ensure your business is well-protected. Stay one step ahead of cybercriminals and enjoy the holidays with peace of mind.

Get in Touch

Ready to secure your business and keep your data safe this festive season? Contact the experts at Leaf IT for tailored cybersecurity solutions that protect your team and assets.

Email us at hello@leaf-it.com and let’s make your business a fortress against cyber threats.

At Leaf IT, we’re dedicated to providing our clients with the best cybersecurity solutions available, which is why we’ve partnered with industry leaders like ConnectWise. As an award-winning Managed Service Provider (MSP), we understand the unique challenges that businesses face in securing their digital environments—especially when it comes to Microsoft 365, a platform that’s become indispensable for communication and collaboration.

With the increasing frequency of cyberattacks targeting Microsoft 365, it’s more important than ever to have a robust defense in place. That’s why we’re excited to offer ConnectWise MDR for Microsoft 365, a comprehensive solution designed to monitor, protect, and automatically remediate any threats to your Microsoft 365 environment.

In the UK, cyberattacks have risen dramatically, with 39% of businesses reporting a cyber incident in the past year alone. Many of these attacks targeted cloud-based services like Microsoft 365, making it clear that traditional security measures are no longer sufficient. ConnectWise MDR for Microsoft 365 offers a sophisticated and proactive approach, allowing your business to stay protected without the need to expand your in-house IT team.

Key features and Benefits of ConnectWise MDR for Microsoft 365

Comprehensive Coverage
ConnectWise MDR seamlessly integrates with Microsoft Defender for Office 365, providing you with comprehensive coverage that leaves no stone unturned. Alerts are not only processed by advanced internal systems but also reviewed by ConnectWise’s team of highly trained and certified security analysts. This dual-layered approach ensures that nothing is overlooked, delivering a level of protection that standard solutions simply can’t match.

Focus on What Matters Most
One of the most significant advantages of ConnectWise MDR for Microsoft 365 is its ability to reduce alert fatigue—a common issue for IT teams. The sheer volume of alerts can be overwhelming, and many are often false positives. ConnectWise MDR effectively filters out these false alarms, allowing your team to focus on high-priority threats that genuinely require attention, thus improving overall efficiency and security.

24/7 Protection Without the Extra Overhead
Cyber threats don’t operate on a 9-to-5 schedule, and neither does ConnectWise MDR for Microsoft 365. With over 200 ConnectWise security operations center analysts monitoring your systems around the clock, you gain peace of mind knowing that your Microsoft 365 environment is continuously protected. This 24/7 vigilance ensures that any threats are identified and dealt with immediately, minimizing potential damage.

Full Integration with Microsoft Defender for Office 365
ConnectWise MDR goes beyond basic alerting by providing actionable data and telemetry, enabling swift and informed decision-making. The solution’s full integration with Microsoft Defender for Office 365 means you can trust that any potential threats will be handled quickly and efficiently, ensuring your business remains secure at all times.

Automatic Remediation and Management
A standout feature of ConnectWise MDR is its ability to automatically contain threats as soon as they are detected. While these automated actions are taking place, further investigations ensure that no threat is left unaddressed. Additionally, ConnectWise’s security analysts manage and resolve alerts within Microsoft Defender for Office 365 on your behalf, significantly reducing the burden on your internal teams and allowing them to focus on core business activities.

Escalations for Severe Threats
In the event of a severe, active threat, ConnectWise security analysts won’t leave you in the dark. They will contact you directly via phone to ensure you’re fully informed and to assist in any further response measures. This proactive approach ensures that serious threats are dealt with promptly and effectively, minimizing potential risks to your business.

Customisable Runbooks and Full Incident Response
At Leaf IT, we recognize that every business is unique, and so are its security needs. ConnectWise MDR allows for customizable runbooks, providing tailored instructions for our team to follow, ensuring our response is aligned with your specific requirements. If an active attack occurs, you also have the option to engage a highly trained incident response team to manage the situation from start to finish, giving you additional peace of mind.

At Leaf IT, we are committed to safeguarding your business’s digital environment. Contact us today at hello@leaf-it.com to learn more about how ConnectWise MDR for Microsoft 365 can help protect your organisation from evolving cyber threats.

In today’s digital landscape, the vulnerability of law practices to cyber threats cannot be overstated.

With a wealth of sensitive client data at stake, from personal information to financial records, law firms are a prime target for cyber criminals. Protecting your firm’s reputation is paramount.

This article delves into practical strategies aimed at fortifying your law practice against cyber threats, ensuring the integrity and security of your data to uphold the trust and confidence of your clients.

Cyber Defence

In the search for cyber defence, partnering with seasoned experts is crucial. Recent Amárach research shows that six out of ten Irish consumers would avoid using a company’s services if they were aware of a data breach.

As the ConnectWise Cyber Security Partner of the Year, Leaf IT stands as a reliable ally in securing your legal practice against digital threats.

With a global Security Operations Centre (SOC) staffed by over 200 certified professionals, Leaf IT offers unparalleled vigilance and protection. Leveraging an industry-leading Systems Information & Event Management (SIEM) system, they provide comprehensive monitoring of your server and network infrastructure, swiftly identifying and neutralizing any anomalies.

Furthermore, their Managed Detection and Response Endpoint application delivers round-the-clock assurance, ensuring that threats on user endpoints are promptly managed and remediated.

By integrating with Microsoft 365, Leaf IT’s SaaS offering enables real-time monitoring of login attempts and geographical anomalies, bolstering your ability to safeguard client data.

Domain and Email Identity Protection

Email identity protection is a vital component of any cybersecurity strategy. In Ireland in 2023, a staggering 70% of cyber-attacks took the form of phishing attacks, according to Hiscox analysis.

These deceptive emails, masquerading as legitimate communications, often appear innocuous at first glance.

While they may not contain malware, their primary aim is to trick recipients into divulging login credentials, granting attackers unauthorised access to accounts.

Additionally, there’s a concerning raise in Cyber Criminals spoofing law firms’ email addresses, aiming to intercept funds by deceiving clients with fraudulent messages, such as fake bank account change notifications.

Implementing robust protocols such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication Reporting & Conformance (DMARC) is essential to defend against email-based attacks.

SPF verifies the authenticity of email senders, while DKIM ensures that recipients can verify the source of emails originating from your domain.

DMARC, the core of email authentication, empowers you to enforce policies dictating the action to be taken on emails failing authentication, thereby minimizing the risk of phishing and spoofing attacks.

Leaf IT partners with reputable solutions providers like Mimecast and Redsift, streamlining the implementation and management of these protocols, protecting your email infrastructure against cyber threats.

Reputation

With reputation on the line and client trust at risk, proactive measures are imperative to safeguarding sensitive data and maintaining operational integrity.

Leaf IT, an award- winning Managed Service Provider (MSP), working with elite legal clients such as AMOSS, OCWM Law, Michael Boylan and more, have a proven track record in securing success.

Ann-Marie O’Shaughnessy, newly appointed Account Manager at Leaf IT Ireland, offers over a decade of IT industry experience, specialising in legal practices and Cyber Security.

Her dedication to delivering practical, personalised solutions sets Leaf apart, ensuring clients receive unparalleled service.

Contact Ann-Marie for a personalised consultation, tailored to the unique needs of your legal firms.

Email: ann-marie.oshaughnessy@leaf-it.ie

Tel: +353 (0) 1 582 4075