The hidden marathon behind the productivity sprint
Google Workspace and Microsoft 365 have become the beating heart of modern business. It promises agility, collaboration, and innovation but beneath the glossy surface lies a stark reality: securing this ecosystem is not a sprint, it’s a marathon. And most organisations underestimate the distance.
The Illusion of “Secure by Default”
When companies migrate to either Google or Microsoft, there’s often an assumption that the platform is inherently secure. After all, it’s a major vendor, surely the defaults are good enough?
The truth: default settings prioritise usability, not security. They leave gaps that attackers exploit daily. Misconfigurations are now among the top causes of breaches, and the Midnight Blizzard attack was a wake-up call for many. The number of configuration changes needed within an organisation to secure it effectively is large and continuously growing.
87 Configuration Changes and Counting
Securing both these platforms isn’t about ticking a box; it’s about transforming posture. Industry baselines and CISA guidance outline 87 critical configuration changes spanning identity, email, endpoints, compliance, and monitoring.
Identity Hardening: MFA, Conditional Access, structured authentication.
Email Defence: Safe Links, Safe Attachments, DKIM, DMARC.
Data Governance: Data Management, sensitivity labels, retention policies.
Privileged Access: Just-In-Time admin rights, Privileged Access.
Continuous Monitoring: Secure Scores, drift analysis, Application audits.
Each change matters. Each one closes a door that attackers would otherwise pry open. Both Google and Microsoft post their relevant checklists for this and both acknowledge that it takes time and effort to achieve. They are listed below:
Google Workspace: Security checklist – Google Workspace
Microsoft 365 – Basic Security Set Up for Microsoft 365
How your security should look...
The Effort necessary for securing these platforms.
Here’s the uncomfortable truth: implementing these changes is resource intensive.
Initial Hardening: Many organisations don’t institute the baselines for securing these platforms. Often this can take days or weeks initially to achieve.
Advanced Configuration: Weeks to months, depending on licensing and complexity.
Continuous Monitoring: A permanent commitment with quarterly audits, monthly reviews, and daily vigilance.
This isn’t just IT work; it’s a cultural shift. It demands skilled personnel, budget allocation, and executive buy-in. Security isn’t a feature. It’s a discipline.
Why Organisations Struggle
Fragmented Responsibility: Security falls between IT, compliance, and leadership.
Tool Overload: Multiple portals, small and specific configurations in unique areas, each with its own learning curve.
Reactive Mindset: Many act only after an incident, not before.
The Provocation: Are We Treating Security Like Hygiene or Like Strategy?
Most businesses treat security as hygiene – something to “clean up” after deployment. But in a world of relentless cyber threats, security must be strategic. It should shape decisions, budgets, and culture.
Ask yourself:
- Would you run a marathon without training?
- Then why run your business on Microsoft 365 without securing it first?
Call to action:
- Start with the basics: MFA, Conditional Access, Secure Score.
- Build a roadmap: Prioritise high-impact changes, then layer advanced controls.
- Invest in expertise: Whether internal or external, skilled hands are non-negotiable.
- Monitor relentlessly: Security is not a project. it’s a lifecycle.
Final Thought
Both Google and Microsoft 365 are both powerful engines for growth, but without security, it’s a high-speed car with no brakes. The effort is significant, yes – but so is the cost of inaction. The question isn’t whether you have budgeted for the effort required to secure these platforms, it’s whether you can afford not to
Latest News and Insights
PKI and Certificate Management the risk most miss.
An expired certificate can take down critical business services faster than many cyber attacks. With certificate lifecycles shrinking, PKI...
Data and Observability Pipelines
Observability pipelines have become a fashionable abstraction although by going down this route organisations are quietly re‑introducing the very...
Recon Partners with CrowdStrike to Elevate Cybersecurity for Australian Businesses
Recon has partnered with CrowdStrike to bring AI-powered cybersecurity to Australian businesses, delivering advanced threat detection and response through...
Google and M365 Security
Google and Microsoft offer great solutions for collaboration, yet the intricacies of these platforms need to be understood to...
Looking to transform your cloud and cyber practices?
Recon transforms cloud and cyber from cost and risk into drivers of growth. Our focus is enabling scale, protecting value, and supporting confident business expansion.