This is a blind spot most teams miss. PIANOLA catches it automatically, no one has to go in and check by hand.
03:17
Scan finds an admin account excluded from the MFA policy
Of the five admin accounts in the environment, four are covered by the Conditional Access policy for MFA. The fifth is listed as an exclusion, is not documented as break-the-glass, and also lacks a phishing-resistant authentication method (FIDO2 or passkey).
03:17
PIANOLA classifies the risk
High. A single compromised exclusion at admin level is enough for a full tenant takeover. Leadership often assumes "everyone has MFA" because Security Defaults or CA is on, but exclusions and legacy auth methods don't surface without active review.
03:18
PIANOLA proposes an action
Document the account as a verified break-the-glass or include it in the CA policy for admin roles. Raise the bar to phishing-resistant MFA. A snapshot of the current policy is saved beforehand. Once you've confirmed the change behaves as expected, you make it permanent.
07:42
Approved by operator
The decision was approved from a mobile.
07:42
Applied and verified
The policy now covers every admin account and requires a phishing-resistant authentication method. PIANOLA verifies via Microsoft Graph and confirms that no admin account is left without strong protection. The evidence is saved for the auditor and insurance.
After
Once you've confirmed the change behaves as expected, you make it permanent
You decide when the action becomes permanent. Everything stays in the history either way.
What's at stake
The sequence above avoids this kind of cost
Three figures that put PIANOLA's preventive work in financial perspective. The full analysis is in the monthly report, mapped to your environment.
Typical cost range for a cyber incident
€0.45M-€2.65M
Truesec Threat Intelligence and Länsförsäkringar cyber incident study for Nordic SMBs, 2024-25
NIS2 sanction ceiling for non-compliance
1.4% of revenue
NIS2 directive, article 34
Avoided consultancy fees for NIS2 documentation
€2.7K-€7K / year
Market average 2026
An ongoing PIANOLA subscription is a negligible operating cost compared to the typical cost range of a cyber incident in the same segment.
Sources: IBM Cost of a Data Breach Report 2024 (global average 4.88 MUSD, 3.31 MUSD for organisations under 500 employees), Sophos State of Ransomware 2024, FBI IC3 Internet Crime Report 2023, and Truesec Threat Intelligence.
What the threat actually looks like
Microsoft 365 is attacked differently from on-prem servers
Because your data is already replicated in the cloud, classic file encryption is uncommon. The damage comes instead from extortion, leaked data, broken customer trust, and lost brand value, often without a single file being deleted.
Business Email Compromise
An attacker hijacks an ongoing email thread and redirects a payment. The direct cost is low compared to the damage to customer and supplier trust once it surfaces.
Source: FBI IC3 Internet Crime Report 2023 (21,489 BEC reports, ~2.9 billion USD in losses).
Tenant takeover and extortion
Stolen credentials or social engineering of the helpdesk give the attacker access to the entire environment. Your data is held for ransom under the threat of public leaks. The real cost shows up in negotiation, legal counsel, communications, and lost business.
Source: MGM Resorts SEC 8-K filing September 2023 (Scattered Spider, social engineering of the helpdesk).
Data exfiltration via OAuth or Graph
Files from SharePoint and OneDrive are exfiltrated via legitimate API calls, often without leaving a visible trace. By the time the leak is reported, the damage to the brand is already done.
Source: Cyber Safety Review Board Report April 2024 on Storm-0558 (the incident was described as "preventable").