AegisAI Perspectives · 103
On a limited budget, stop BEC with the Microsoft 365 controls you already license, then pay only for a layer that checks payment requests against history.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
On a limited budget, stop BEC with controls you already license, such as Defender for Office 365 Plan 1 at $2.00 per user a month7, then pay only for the gap. That gap is a payment request from a hijacked vendor mailbox, which signs as itself, so email authentication passes19. AegisAI's AI agents check every payment request against the sender's history to stop it. Microsoft 365 Business Premium and E3 already include Plan 12.
Several BEC controls come with the Microsoft 365 plan a mid-market company already pays for. Zero-hour auto purge (ZAP) has no special licensing requirement and works on every mailbox hosted in Exchange Online14. It retroactively removes phishing, spam or malware already delivered to cloud mailboxes, but it searches only the last 48 hours of delivered mail.
Defender for Office 365 Plan 1 protects email from phishing and business email compromise, as well as zero-day malware1. Microsoft lists Plan 1 at $2.00 and Plan 2 at $5.00 per user a month, paid yearly. Business Premium and E3 carry Plan 1 at no extra cost. For the price ranges of paid tools on top, use what a business pays per user for email security.
Open your licence list in the Microsoft 365 admin center and write down which of these controls you already pay for.
Short on time? Watch the explainer, or book a demo.
Impersonation protection is the big one: by default no sender addresses are set for it, in the default policy or in any custom policy4. So no executive or supplier is protected until an admin adds them. Each anti-phishing policy takes up to 350 protected users and up to 50 custom protected domains. That is room for the people who approve payments plus the suppliers who send invoices.
Sign-in needs the same attention. The NCSC ranks FIDO2 MFA first because it resists guessing, phishing and theft22. Authenticator app codes follow the TOTP standard, which sets a default time step of 30 seconds24. The NCSC warns those codes can be intercepted by phishing, so use them only where FIDO2 is not yet in place.
List the users and supplier domains to protect this week, before any purchase order goes out.
Do these in order. Steps 1 to 6 are settings and process, not new licences.
Require phishing-resistant MFA for every admin and finance user, with FIDO2 first as the NCSC advises.
Add executives and payment approvers to user impersonation protection in the anti-phishing policy, up to 350 per policy.
Add your own domains and your top supplier domains to domain impersonation protection, up to 50 per policy.
Publish a DMARC record for every domain you send from, so receivers can apply your domain-level policy to spoofed mail17.
Confirm ZAP is acting on phishing and malware, and note that it reaches back only 48 hours.
Write a finance rule: every new or changed bank detail is confirmed by a call to a number already on file, never one from the email.
If your plan lacks Plan 2, try Defender for Office 365 free for 90 days and record what it adds3.
Put the seven steps in one change ticket with a named owner for each.
A payment request from a hijacked supplier mailbox passes the authentication checks they rely on. The FBI defines BEC as a scam aimed at businesses that work with suppliers or make regular wire transfers11. Its 2025 report lists BEC losses of $3,046,598,558, up from $2,770,151,146 in 2024.
DMARC lets a domain owner state a policy for validating its mail. A hijacked vendor mailbox signs as itself, so that check passes. Impersonation protection matches senders posing as the users and domains you listed, and a hijacked mailbox poses as no one.
Treat every bank detail change that arrives by email as false until finance confirms it by phone.
A paid layer earns its cost only when it catches the request the native stack passes. Microsoft lists the trade-offs of adding a non-Microsoft service: more cost, more complexity, and a false positive rate that rises as products are added15. It also says no number of layers reaches 100 percent protection.
Hold every candidate to four tests:
For the wider buying checklist beyond BEC, use how a small or mid-sized business should choose email security.
Score each candidate on these four tests before you ask for a price.
The cheapest layers are settings and process, and the paid layer is the last row.
| Layer | What it covers | Cost per user | Where AegisAI fits |
|---|---|---|---|
| ZAP | Phishing, spam or malware already delivered, within 48 hours | No special licence needed | Not involved: a platform feature |
| Defender for Office 365 Plan 1 | Phishing and BEC in email | $2.00 a month, or included in Business Premium and E3 | Not involved: a platform licence |
| Impersonation protection | Senders posing as up to 350 listed users and 50 listed domains | No extra cost, but empty by default | Not involved: a tenant setting |
| Phishing-resistant MFA | Account sign-in, FIDO2 first as the NCSC advises | Depends on your identity plan | Not involved: an identity setting |
| Callback to a known number | A bank change that passed every email check | No licence cost | No edge: a phone call to a number on file settles it |
| Paid layer in read-only mode | Payment requests from hijacked mailboxes that pass authentication | Vendor quote | Checks every payment request against the sender's history |
60-second self-check
Six questions. Nothing is sent anywhere; the result shows on this page.
Fund the rows from the top, and add the last row only after a trial shows what it catches.
Illustrative example, figures are fictional. Harbor Lane Logistics (fictional) has 900 mailboxes on Microsoft 365 E3, which includes Plan 1. The admin adds 40 payment approvers to user impersonation protection and 30 supplier domains to domain impersonation protection, inside the 350 and 50 limits. Moving all 900 mailboxes to Plan 2 at the $5.00 list price would cost $4,500 a month. Instead, the team runs a read-only layer for 30 days. Finance receives 12 bank change requests by email, and all 12 pass email authentication. The layer flags 5. The callback confirms 2 as fraud, and the other 3 are false alarms that cost finance about 20 minutes each. The decision rests on 2 frauds caught against 60 minutes of review.
Rerun this arithmetic with your own mailbox count and bank change log before you sign anything.
A hijacked vendor mailbox signs as itself, so SPF, DKIM and DMARC pass. AegisAI's AI agents check every payment request against the sender's history, and stop the business email compromise that authentication lets through. The platform connects by API and works after delivery20. It runs in monitoring mode first21.
Track three numbers from the day the settings go live.
To count a paid layer's catches on your own mail in monitoring mode, set up a tenant trial.
The best value is the native stack set up properly, then one paid layer that judges payment requests. Plan 1 lists at $2.00 per user a month and comes with Business Premium and E3. Pay for more only to catch requests from hijacked mailboxes that pass authentication.
Plan 1 covers BEC in email, but the anti-phishing policy's impersonation list starts empty. Microsoft's own guidance says no stack of layers reaches 100 percent. Set up the policy and the callback rule, then test whether a paid layer catches what remains.
DMARC lets receivers apply your domain-level policy to mail that fakes your domain. A hijacked supplier mailbox signs as itself, so it passes DMARC.
Each anti-phishing policy takes up to 350 protected users and up to 50 custom domains. Put payment approvers and executives in first, then the suppliers that send invoices.
The FBI's 2025 report lists BEC losses of $3,046,598,558, against $2,770,151,146 in 2024. The FBI ties BEC to businesses that pay suppliers or send regular wire transfers.
Yes. If your subscription does not include Plan 2, Microsoft lets you try Defender for Office 365 free for 90 days. Use that window to count what the trial adds over your Plan 1 baseline.
