Centeye blog
Security, explained for MSPs and the businesses they protect.
Plain-English guides to the attacks that matter now: identity, email, ransomware, AI and AI agents. Every figure names its source.
MFA security: which MFA methods actually stop attacks
Not all multi-factor authentication is equal. Text codes and push approvals get bypassed; passkeys and security keys don't. A plain ranking of MFA methods, how each one gets beaten, and what to roll out first.
Latest
- Identity attacks Microsoft 365 account compromised: what to do in the first hour
- Identity attacks Device code phishing: the Microsoft 365 sign-in scam that skips your password
- Ransomware and endpoints What is EDR? Endpoint detection and response explained
- Identity attacks Token theft in Microsoft 365: how stolen sessions skip MFA
MFA security: which MFA methods actually stop attacks
Not all multi-factor authentication is equal. Text codes and push approvals get bypassed; passkeys and security keys don't. A plain ranking of MFA methods, how each one gets beaten, and what to roll out first.
Microsoft 365 account compromised: what to do in the first hour
A client calls: 'my account is sending spam.' A step-by-step first hour for a compromised Microsoft 365 account: contain it, cut off the attacker's sessions, find what they changed, and check who else got the emails.
Device code phishing: the Microsoft 365 sign-in scam that skips your password
In device code phishing, people type a code on the real Microsoft sign-in page and hand over their account, MFA and all. How it works, a worked example, and how to block it in Microsoft 365.
What is EDR? Endpoint detection and response explained
EDR watches how programs behave on laptops and servers, so it catches the hands-on attacks antivirus misses, and it can stop them on the machine. What EDR does, a worked example, and what to check before you buy.
Token theft in Microsoft 365: how stolen sessions skip MFA
MFA is on and the account still gets taken over. Token theft is why: the attacker steals the session after MFA, not the password. How it works, a worked example, and the steps that stop it.
AI security risks for businesses: the 7 that matter
The AI security risks that actually hurt small and mid-sized businesses in 2026: data in personal AI accounts, AI apps with mail access, Copilot oversharing, ownerless agents, prompt injection and AI-powered attacks. What each looks like and how to cut it.
Shadow AI statistics 2026: what the data says about AI at work
The 2026 shadow AI statistics that matter: how many people use AI on personal accounts, what they paste into it, and what AI-related breaches cost. Every figure from a named 2026 source, with what to do about it.
Copilot governance checklist for MSPs: how to answer "is Copilot safe to switch on?"
A Copilot governance checklist for MSPs: who decides, which data Copilot can reach, who can build and share agents, the usage rules staff follow, and the monthly review that keeps a client's Copilot rollout safe.
Cybersecurity statistics for small and mid-sized businesses in 2026
The 2026 numbers that matter for small and mid-sized businesses and the MSPs that protect them: how attackers get in now, what ransomware and email fraud cost, and how AI tools and agents change the risk. Every figure from a named 2025–2026 source.
What is SSPM? SaaS security posture management, and why AI agents change it
SSPM (SaaS security posture management) means checking the settings, admins and connected apps of platforms like Microsoft 365 and Google Workspace, all the time, not once a year. What SSPM covers, how it differs from CASB and CSPM, and what changes now that AI agents connect to everything.
Insider threats: definition, types and the signs in Microsoft 365 and Google Workspace
An insider threat is risk from someone who already has access. Here are the three types of insider threats, the signs they leave in Microsoft 365 and Google Workspace, a worked example and a checklist to catch them early.
Microsoft 365 security checklist for small and mid-sized businesses
A practical Microsoft 365 security checklist for small and mid-sized businesses and the MSPs who run them: sign-ins, admin accounts, mail, sharing, apps and monitoring, with what each setting needs and what to check first.
Microsoft ITDR explained: Defender for Identity, Entra ID Protection and the gaps for MSPs
What Microsoft ITDR is made of: Defender for Identity and Microsoft Entra ID Protection, what each one watches, which licences they need, and the gaps MSPs should check for clients on Business Premium.
You've found your AI agents. Do you know who they talk to?
Agent discovery gives you a list. It doesn't show which apps, agents and tools each agent talks to, or where data goes next. Here's why agent connections are the blind spot in agent sprawl, and how to map and protect them.
AI agent identity: why every agent needs its own account, owner and off switch
Too many AI agents run on shared admin accounts or a person's own login. Here's what AI agent identity means, why it matters, how Microsoft Entra Agent ID and Google's agent accounts change things, and a checklist to fix it.
Copilot agent security: securing Microsoft 365 Copilot agents, Copilot Studio and Foundry agents
Your teams are building Copilot agents: in Copilot Chat with Agent Builder, in SharePoint, in Copilot Studio and in Microsoft Foundry. Here's what each kind can reach, where the agent control plane breaks, and how to be confident your Copilot agents are secure.
Gemini Enterprise agent security: securing Gemini agents in Google Workspace
Google's Gemini agents now get their own Workspace accounts, email addresses and Drive storage. Here's what that means for security, what Google gives admins, where the gaps are, and a checklist for Google Workspace businesses and MSPs.
Is Microsoft Agent 365 enough? What you get out of the box, and what's still on you
Microsoft Agent 365 gives every agent an identity, a registry and usage reports. Here's what comes free, what the $15 licence adds, and the gaps businesses and MSPs still have to close themselves: agents outside Microsoft, grants, connections and every client in one view.
Copilot agents for MSPs: how to adopt, secure and sell agent security across every client tenant
Clients want Microsoft Copilot agents to automate business processes, and security comes up in the very next sentence. A guide for MSPs, MSSPs, integrators and ISVs on discovering, authorising and securing Copilot agents across many tenants, and turning it into a service.
How Synthagent works: the guard agent that supervises your AI agents through identity and access
A plain-English walk-through of Synthagent, the guard agent inside Centeye Synthwatch: how it knows every agent, spots one going off script, links it to the person behind it, and stops it within your rules.
What is Synthagent? The guard agent that protects your AI agents' four control layers
Synthagent is the guard agent inside Centeye Synthwatch. It watches every AI agent's identity, authentication, grants and connections, links what it sees to the people and data around it, and fixes problems in place. Here's how it works.
AI agent sprawl: the wave of agents coming to Copilot, Microsoft Foundry and Gemini
Over the next year, most businesses will go from a handful of AI agents to dozens, built in Copilot Studio, Microsoft Foundry and Gemini Enterprise. Here's where they'll come from, what goes wrong when nobody owns them, and how to get ahead of agent sprawl.
Copilot security: what Microsoft 365 Copilot can see, and how to check before you switch it on
Is Copilot safe? Microsoft 365 Copilot only shows people what they can already open, but most businesses share far more than they realise. Here's what Copilot can see, where the real risks are, and a checklist to run before rollout.
How to secure AI agents in Microsoft 365 and Google Workspace: a 6-step plan
AI agents built in Copilot Studio, Microsoft Foundry and Gemini Enterprise hold real access to your data. Here's a practical six-step plan to find them, give each an owner, limit what they reach, watch how they behave and stop them fast.
What is shadow IT? Meaning, risks and how it differs from shadow AI
Shadow IT means apps and services people use for work without IT approving them. Here's what shadow IT looks like in Microsoft 365 and Google Workspace, why connected apps are the real risk, how it differs from shadow AI, and how to find it.
AI usage policy: a one-page template for small and mid-sized businesses
Most staff already use AI tools at work, often from personal accounts. Here's a plain-English, one-page AI usage policy template you can copy, plus how to roll it out and how to tell if people are following it.
AiTM phishing: how attackers get past MFA with a fake login page
Adversary-in-the-middle (AiTM) phishing steals the session, not just the password, so MFA doesn't stop it. Here's how the attack works, a worked example, and the man-in-the-middle prevention steps that actually help.
AI governance for law firms, medical practices and financial firms
Regulated businesses are using AI as fast as everyone else, but client and patient data raises the stakes. Here's what regulators and professional bodies have said, and the practical AI governance steps that follow.
EDR vs. MDR vs. AV for small business: what's the difference, and what do you actually need?
AV, EDR and MDR get used as if they mean the same thing. They don't. Here's a plain-English breakdown, a worked example, and how small and mid-market businesses get EDR-grade detection with someone acting on it.
Is Microsoft Defender enough for small business? An honest assessment
Defender for Business is genuinely good, and genuinely incomplete. Here's what it covers, where the gaps are (identity, email fraud, after-hours response), a worked example, and how to close them without ripping it out.
ITDR vs EDR: what's the difference, and do you need both?
ITDR watches the accounts people sign in with. EDR watches the laptops and servers they use. Here's what each one catches, where each one is blind, and how MSPs decide which clients need both.
Shadow AI detection: how to find the AI tools already in use
Most staff already use AI tools nobody approved. Here's where shadow AI hides, five ways to detect it in Microsoft 365, Google Workspace and the browser, and what to do with what you find.
What are guardian agents? The AI that keeps your AI agents in line
Guardian agents watch other AI agents: what they can reach, what they actually do, and when to stop them. Here's what a guardian agent is, why businesses adopting AI agents need one, and what a good one must do.
What is ITDR? Identity Threat Detection & Response, explained for SMBs
Identity is now the main way attackers get in, not laptops. Here's what ITDR is, the attacks it catches (stolen sessions, MFA fatigue, risky app consent), why MFA alone isn't enough, and a checklist to see if you're covered.
Why MSPs need an AI security team, not another dashboard
Small and mid-market businesses are now where most attacks land, and the gap is people, not tools. Here's why MSPs need an AI security team that does the digging on every case, and how to judge one.
How to protect a business from ransomware: what actually works
Ransomware protection that works in 2026: how attacks really start, the controls that stop them, a checklist you can run this week, and what to do in the first hour if it hits.
What is business email compromise (BEC)? Real attack examples and how to stop it
Business email compromise cost US victims over $3 billion in 2025. Here's how a BEC attack works, real examples, the warning signs, and a checklist to stop it in Microsoft 365 and Google Workspace.
AI agent governance and non-human identity: a practical guide
AI agents now sign in, read mail and move files on their own. Here's what non-human identities are, why AI agents are the riskiest kind, and the five questions every business should be able to answer about each agent.
AI data leaks: how company data ends up in ChatGPT, and how to stop it
Most AI data leaks aren't hacks. They're people pasting customer lists, contracts and code into AI tools. Here's how it happens, what the numbers say, and how to keep AI useful without leaking data.
MFA fatigue attacks: how push bombing works and how to stop it
MFA fatigue (push bombing) floods a user with sign-in prompts until they tap approve. Here's how the attack works, the signs to watch for, and the steps that stop it in Microsoft 365 and Google Workspace.
What is an AI SOC? A plain-English guide for MSPs
An AI SOC uses AI agents to do the first pass of security operations work: triage, investigation and routine fixes. Here's what it really does, where it falls short, and how MSPs should judge one.
What 'AI-native security' actually means in 2026 — and how to spot a chatbot bolt-on
Every vendor now says 'AI.' The data shows AI is genuinely reshaping both attack and defense — so here are five questions that separate AI-native security from a chatbot bolted onto an old product.
Alert-only vs. auto-contain: why your security should act, not just notify
By the time an alert reaches a human, the attacker may be hours from your domain controller. The data on attack speed, off-hours deployment, and alert fatigue makes the case for graduated, human-in-the-loop auto-containment.
How a modern attack chains across email, identity, and your endpoints
Real breaches aren't single events. They relay from a stolen login to your domain controller in about 11 hours — and the hand-offs between surfaces are exactly where single-product tools go blind. Here's the data.
The cyber-insurance readiness checklist for SMBs (2026)
41% of SMB cyber-insurance applications are denied on first submission. Here are the eight control families carriers actually check — and how to prove each one before your renewal.
Security as an MSP growth and margin lever: the 2026 channel opportunity
Cybersecurity is the fastest-growing line in the MSP book, demand is surging, and there's a 35-point AI delivery gap. Here's how to turn security from a cost center into your strongest growth lever.
Consolidating point tools into one AI security platform: the case against tool sprawl
77% of organizations run 10+ security tools, yet only 4% are 'mature.' Here's why stacking point tools doesn't add up to security — and what a consolidated AI platform changes.
How an MSP runs 24/7 security without a 24/7 team
Threats don't keep business hours, but most MSPs can't staff a night shift. Here's how an AI security team delivers around-the-clock detection and response across every client — without the headcount.
Shadow AI and non-human identities (NHI): the security blind spot of 2026
Shadow AI was involved in 20% of breaches and added $670K to the average cost. Here's what shadow AI and non-human identities are, why they're invisible, and how to govern them.
Why SMBs are now the primary ransomware target (and what the data says to do about it)
70% of human-operated ransomware now targets companies under 1,000 employees, and the median victim is 200. Here's why attackers moved downmarket — and the controls that actually work.
See one attack, end to end.
A 30-minute intro call on sample data, or a free trial on your own tenant.