Security questionnaires used to ask whether you had policies. Increasingly, they are asking whether your company can actually receive a security signal, route it to someone with authority, fix the issue, and prove what happened. That sounds administrative until you look at the threat news from the last two weeks.

On September 22, 2026, Microsoft said it disrupted EvilTokens, a cybercrime platform that used AI across phishing, email compromise, fraud planning, and scam operations. Axios reported the same day that Microsoft estimated EvilTokens had compromised more than 12,000 email inboxes across 10,000 organizations, including construction, financial services, real estate, higher education, and healthcare. This was not a niche problem for giant enterprises. It was exactly the kind of cross-industry identity compromise that lands in the inboxes, SaaS accounts, and vendor workflows of smaller companies.

Two weeks earlier, on September 9, 2026, Microsoft Security Research described passkey-themed social engineering that led to identity and cloud compromise. The attack flow included convincing authentication enrollment lures, attacker-added authentication methods, Microsoft Graph reconnaissance, SharePoint and OneDrive downloads, and email collection through APIs. The operational lesson is blunt: the attacker is not just trying to get a password anymore. They are trying to become a believable user, persist inside the identity system, and quietly turn cloud email into an extraction surface.

Email Security Is No Longer Just Filtering

For founders and operators, this changes the shape of email security work. A phishing message that lands in an inbox is only the first move. The larger question is whether your environment can detect the sequence after the click: unusual device-code sign-in, new MFA method registration, suspicious OAuth consent, bulk mailbox access, inbox-rule creation, Graph API spikes, SharePoint downloads, or impossible travel.

That means the minimum practical control set should include SPF, DKIM, and DMARC for your sending domains; phishing-resistant MFA for administrators and finance roles; conditional access policies that treat device code, unmanaged devices, and risky locations carefully; alerts for new authentication methods; and recurring review of OAuth applications with mailbox, file, or directory permissions. This is not about buying every tool on the market. It is about making sure the identity platform, email platform, and ticketing workflow agree on what a serious signal looks like.

Small teams should also stop treating the security@ mailbox as a symbolic address. It needs ownership, monitoring, backup coverage, and a response clock. If an employee reports a suspicious consent screen, a customer forwards a spoofed invoice, or a vendor sends a compromise notice, the message should not disappear into a shared inbox that nobody checks on Fridays.

FedRAMP Is Turning Contactability Into A Control

FedRAMP’s 2026 communication requirements show where the market is heading, even for companies that will never sell directly to the federal government. The FedRAMP Security Inbox requirements became effective on January 5, 2026. FedRAMP later stated that its grace period expired on July 1, 2026, and its FY26 Q4 test notice on July 7, 2026 required providers to complete actions by July 14, 2026 at 5:00 PM Eastern.

The important part is not the federal acronym. It is the expectation: urgent security communications must reach a senior security official, avoid unnecessary sender friction, receive human review, and be handled within defined timelines. That maps directly to what larger customers increasingly want from vendors in SOC 2, PCI, HIPAA, and enterprise procurement reviews. They want confidence that when something goes wrong, your company can be reached and can act.

For a growing business, this becomes a simple but powerful readiness pattern. Create a security intake address. Route it to named owners and a backup. Keep it out of ordinary sales support queues. Test it quarterly. Record when the message arrived, who acknowledged it, what system was checked, what decision was made, and what evidence was retained. That log becomes useful during incidents, renewals, audits, and questionnaire season.

Patch Triage Needs The Same Routing Discipline

The same response problem appears in vulnerability management. Cisco published a set of Cisco Identity Services Engine advisories on September 16, 2026, including a September hardening release and multiple ISE vulnerabilities. For many small companies, network access control, VPN, firewall, SSO, device management, and backup products are operated by a lean internal team or an outside IT provider. A critical vendor advisory is only useful if someone knows whether the product is deployed, what version is running, who can patch it, and how quickly the change can be made.

This is where vulnerability management often breaks down. Teams have scanner output, vendor emails, insurance questionnaires, and compliance frameworks, but no clean decision lane. A practical workflow ranks issues by exploit activity, internet exposure, affected business process, compensating controls, and owner availability. CISA’s Known Exploited Vulnerabilities catalog is useful because it pushes teams away from pure CVSS sorting and toward evidence of real-world exploitation.

For a small business, the right artifact is not a 40-page vulnerability policy nobody reads. It is a live register with assets, owners, severity, exploit status, due dates, exceptions, and proof of remediation. The register should connect to the security inbox so vendor advisories and customer-reported issues become trackable work, not scattered messages.

Build The Evidence While You Operate

The easiest time to collect audit evidence is while doing the work. When you enable DMARC, keep the DNS record and enforcement date. When you roll out phishing-resistant MFA for admins, keep the policy screenshot and user scope. When you remove a risky OAuth app, keep the ticket, approval, and before-and-after permissions. When you patch an exposed system, keep the advisory, affected version, fixed version, deployment date, and validation note.

This is the bridge between security operations and sales readiness. A prospect may ask, “How do you handle phishing?” A stronger answer is not a paragraph about awareness training. It is a short packet showing email authentication, MFA coverage, suspicious sign-in alerting, security inbox routing, incident escalation, and recent response evidence with sensitive details redacted.

The action item for this week is straightforward: treat your security inbox, identity controls, and vulnerability queue as one operating system. Pick one owner. Test one inbound security message. Review admin MFA methods. Export current OAuth app permissions. Check your top exposed vendors for September advisories. Then save the evidence. GGEZ helps teams turn that kind of work into durable controls, not theater for the next questionnaire.

Why this matters

GGEZ can help small and midsize teams turn this into practical controls: harden email and identity, create security-response routing, prioritize exploited vulnerabilities, and maintain evidence packets that support SOC 2, PCI, HIPAA, and FedRAMP-oriented questionnaires.

Sources

Need help applying this?

If your team needs practical security help instead of generic checklists, GGEZ can help you harden the basics and organize the work. See the related service area.