Guest Post
At Huntress, we spend a lot of time looking at endpoints after an attacker has made a mess of them.
Lately, that mess has become harder to spot. Attackers are signing in with valid credentials, abusing legitimate tools already installed in the environment, and counting on defenders to mistake suspicious activity for normal work. The Huntress 2026 Cyber Threat Report, based on telemetry from more than 4 million endpoints and 9 million identities, found that attackers are blending into everyday activity more effectively instead of relying primarily on noisy, custom malware.
Ransomware groups are also taking their time. Huntress reported that time-to-ransom stretched from 17 to 20 hours as attackers stay hidden in an environment and take their time preparing to steal data and extort victims.
That matters to anyone responsible for Microsoft 365 data protection. Microsoft 365 may be cloud-based, but endpoints remain key to the data story: files can be stored, edited, cached, synchronized, exported, and shared from those devices.
And yet endpoints are often overlooked.
The endpoint is a large part of the Microsoft 365 data story
A number of issues come with relying on M365 as your sole layer of data protection. After all, a file can exist on a laptop without ever reaching OneDrive. A sync client can reproduce an unwanted deletion across connected locations. A browser session can carry a valid identity into Microsoft 365, even after a password has been changed.
It’s easy to forget that endpoints hold the tools people use to move and protect data: file-transfer utilities, administrative tools, sync clients, and more.
Falling behind on endpoint monitoring has consequences. We saw it firsthand in May 2026, in our investigation of two incidents involving “The Gentlemen” ransomware operation. In one attack, a hacker used a compromised account to connect over Remote Desktop Protocol (RDP), launched the encryptor from the user’s Documents folder, and eventually encrypted files and left behind a ransom note. In another attack, file encryption had already started several days before the Huntress agent was installed. By the time the endpoint was visible to defenders, the attacker had already done significant damage.
These attackers understand the value of a compromised endpoint, even in the age of the cloud. Too often, unsecured devices hold essential files, workflows, trackers, and important previous versions (even when corporate policy says they’re not supposed to).
Take a minute to think about it: what files are only saved on the endpoint you’re on right now? Do you know?
Protection and recovery: Two parts of Microsoft 365 data resilience
Microsoft 365 data protection has to include endpoint coverage organization-wide. Antivirus isn’t enough. M365 built-in protections aren’t on their own, either. Nowadays, email security, identity monitoring, endpoint detection, and backup plans are all necessary parts of a resilient defense-in-depth strategy. While identity monitoring can flag suspicious logins and new device registrations, and endpoint detection can identify credential theft and unusual file movement, backup is needed for cloud files, cloud collaboration tools disguised as backup, and endpoints themselves.
Microsoft describes cloud security as a shared responsibility. Its services provide resilience and recovery features, but customers—and the tools they use—remain responsible for protecting their data and meeting their own business and compliance requirements.
Protection has to include endpoint recovery
We think protection and recovery are equally important, especially at the endpoint level. Email security, identity monitoring, and endpoint detection—as good as they can be!—can’t be your only line of defense, since they can’t restore a file that was deleted, overwritten, or encrypted before the incident was contained.
It should really mean something that a cybersecurity organization is stressing this: endpoint backup is a necessity.
And the best endpoint backup services we see provide the final, reliable recovery layer through continuous, automatic copies and version history, allowing teams to return data to a point before the damage occurred.
Of course, your recovery also has to work across the organization. IT should be able to manage coverage across employee devices and restore what is needed, whether that means one file or an entire endpoint. That way, if prevention fails, the organization has a dependable way to recover and keep operating.
Choose the protections that fit the failure you need to survive
As we’ve been stressing, no single cybersecurity layer is complete on its own. The goal is not to find one tool that prevents every attack—because it doesn’t exist. Instead, the real goal is to minimize threats, and their impacts, to degrees that are manageable for your organization.
So practically, you should be asking:
- What data needs to be restored in the event of a ransomware attack?
- How long can the business operate without it?
- How far back might the team need to recover?
- Who can restore the data if the main administrator account is compromised?
- Can the team test the answer without turning recovery into a six-month project?
The answers will vary. Small teams have different requirements than enterprises, and a company with strict retention expectations may need to prioritize storage location, recovery windows, or auditability. But ultimately, every organization has to understand what it needs to protect, what it can recover, and how quickly it can recover it.
Security and recovery capabilities continue to improve, and organizations that combine them thoughtfully are better positioned to detect, contain, and recover from attacks. But that progress is also widening the gap between organizations with layered, tested protection and those still relying on the basics.
That concern extends beyond the security team. Businesses can plan carefully for growth, revenue, and the next stage of development, yet still overlook a growing competitive edge: the ability to keep operating when an attack hits.
About the Author
