Last month, an email from "the CEO" landed in the inbox of one of our clients' finance directors: the executive, supposedly on holiday, was urgently requesting a USD 285,000 wire transfer to a business partner in New Zealand. The email carried the correct signature block. The subject line mirrored the senior executive's real writing habits. The company's Microsoft Defender for Office 365 license was active. And yet the email reached the inbox without triggering a single alert — perfectly timed for Friday, end of business hours.
This story ended well: the finance director called us out of suspicion, and within minutes we spotted the spoofed "reply-to" address, so no money moved. But the attack illustrated a fundamental truth once again: Microsoft 365's built-in protection misses a meaningful share of sophisticated email attacks. And this isn't a flaw in Microsoft's product — it's the natural consequence of an architectural limitation.
In this article, we share four attack categories we've observed across our enterprise clients in Türkiye, and the structural limits of Microsoft 365. We then explain why an API-based solution like Check Point Harmony Email & Collaboration should be deployed not in place of Defender, but alongside it.
1. Let's Be Clear First: What Exactly Is Microsoft 365 Email Security?
"Microsoft 365 email security" isn't a single product; it consists of three layers, and most customers don't know which level of protection their own license actually provides.
- Exchange Online Protection (EOP): The standard component of every Microsoft 365 plan. It blocks known malware signatures, obvious spam, and blacklisted sender domains. A baseline filter.
- Microsoft Defender for Office 365 — Plan 1: Usually comes with an E5 license or as a separate purchase. Adds advanced features such as Safe Links (URL verification), Safe Attachments (sandboxing), and anti-phishing policies.
- Microsoft Defender for Office 365 — Plan 2: Provides incident-management features such as Threat Explorer, Automated Investigation and Response (AIR), and Attack Simulator.
The reality in the field: Among the mid-sized businesses we meet in Türkiye, more than 60% run EOP only. The overwhelming majority of customers who assume "we have Microsoft 365, so our email is protected" actually have nothing beyond the most basic anti-spam filter. Even those with Defender Plan 1 remain exposed to some of the modern attack types described below.
2. The Architectural Limits of Microsoft 365 — Why Can't It See Certain Attacks?
Microsoft's email security infrastructure, including Defender for Office 365, uses a gateway-based architecture. Email first reaches Microsoft's filtering layer, is validated there, and is then delivered to Exchange Online (the inbox). This architecture carries two core weaknesses:
- Threats originating "from inside" go unseen. If an attacker compromises a Microsoft 365 account (account takeover) and sends phishing from within the inbox, the message has already been accepted "on the Microsoft side" and doesn't pass through an additional filter. Internal phishing isn't as common as external phishing, but it's far harder to catch.
- A single vendor inspects its own platform. If there's a vulnerability or misconfiguration in Microsoft's own email service, protection is similarly limited at the same point. There is no independent inspection layer.
This isn't to brand Microsoft as a poor product — on the contrary, EOP and Defender catch most ordinary threats. But a meaningful portion of targeted, inherently sophisticated attacks remains invisible by the very nature of the architecture.
3. The Four Attack Categories Microsoft 365 Misses
3.1 BEC (Business Email Compromise) / CEO Fraud
Definition: An email that contains no malware, carries no suspicious attachment or link, and is written purely with social engineering. The display name of the "CEO" is impersonated; the reply-to address is spoofed; a look-alike domain (for example, kinetlkbilisim.net) is used.
Why Microsoft 365 misses it: There's no technically malicious element in the content. Anti-spam heuristics only catch statistical anomalies; at a company where a CFO receives 200 wire-transfer emails a year, the 201st isn't an anomaly.
Kinetik Bilişim field note: 85% of the BEC attacks we've seen in Türkiye were prepared by scraping the target company's organizational hierarchy from its LinkedIn page. Attackers typically trigger the attack "while the executive is away" (when the out-of-office auto-reply is on). That timing is no coincidence; it's tracked deliberately.
3.2 Quishing — QR-Code Phishing
Definition: There's no clickable URL in the email body; instead, there's a QR-code image. Picture an email saying "Scan the QR with your phone to renew MFA." The user scans the QR with their personal phone rather than the corporate computer — and is sent straight to a fake credential-harvesting page.
Why Microsoft 365 misses it: URL filters (Safe Links) scan only the links in text, so they never see the QR code. Decoding a QR code's contents and scanning the destination URL is only possible with an engine that performs visual-content analysis. Microsoft began adding this partially in late 2025; however, its performance is not yet consistent.
Kinetik Bilişim field note: Quishing is one of the fastest-growing attack vectors of the past 12 months. We see it heavily among our Turkish clients who have recently moved to Microsoft 365, because users haven't yet developed the "suspicious QR code" instinct.
3.3 Account Takeover (ATO) and Lateral Movement
Definition: A Microsoft 365 user's credentials are stolen (often from a prior data breach, or via an MFA-bypass technique). The attacker accesses the user's inbox, reads the correspondence, and then sends phishing — internally or to customers — from that same user's account.
Why Microsoft 365 misses it: Because the sender is an "authorized user," all SPF / DKIM / DMARC checks pass successfully. Microsoft's usual login-anomaly detection does run, but in a scenario as ordinary as a login from Türkiye followed by an email sent from Türkiye, an alert often doesn't fire.
Kinetik Bilişim field note: The biggest indicator of ATO attacks is the mailbox rules created in the inbox (for example, "move all emails containing 'accounting' to the trash"). Defender Plan 2's Threat Explorer catches this — but only for those who have Plan 2 and who review it manually. An API-based solution scans these mailbox rules in real time.
3.4 Zero-Day URLs and Advanced Phishing
Definition: The attacker phishes through a new domain that goes live seconds after the email is sent. When Safe Links scans the email, the URL is still "clean"; by the time the user clicks, the URL now redirects to a live phishing page.
Why Microsoft 365 misses it: Defender's "click-time protection" exists, but only works on URLs that have been rewritten by Safe Links. A page hosted via a CDN, or a phishing page tucked inside a legitimate SaaS service (e.g., Google Drive, OneNote), can appear clean even at click-time.
Kinetik Bilişim field note: Nearly 40% of the Turkish-language phishing campaigns we've seen in the past six months used a legitimate SaaS service as an intermediate step (bit.ly, t.co, even SharePoint's own links). These are multi-stage attack chains that a single URL filter cannot catch.
4. The Solution: Not Replacing Defender, but Adding a Layer on Top
A common misconception is when Microsoft 365 customers ask, "So do I have to throw everything out and switch to Check Point?" The answer is: No. Microsoft Defender for Office 365 is still valuable, and you continue using your existing license. But you do need to add an extra inspection layer in front of — or beside — it.
The API-based (Integrated Cloud Email Security, ICES) approach
Traditional Secure Email Gateway (SEG) architectures change the MX record and route email through an external gateway first. This creates both delivery latency and a blind spot that cannot see internal phishing.
Check Point Harmony Email & Collaboration, by contrast, connects to Microsoft 365's Graph API. That means:
- It sees all incoming and outgoing email — so it scans internal phishing too.
- It also analyzes the context of emails as they extend into SharePoint, OneDrive, and Teams (an attack doesn't end at the email).
- The MX record doesn't change, there's no delivery latency, and it doesn't touch your existing Defender configuration.
- It offers three modes: monitor (observe only, don't intervene), detect & remediate (pull a malicious email back from the inbox after delivery), and inline (block before it ever reaches the inbox).
Check Point's infrastructure is powered by ThreatCloud AI, a cloud intelligence layer with more than 50 AI engines. Threat data from over 65,000 customer environments is shared worldwide within minutes. In the 2025 Gartner Magic Quadrant for Email Security, Check Point is positioned as a Leader.
Catch performance, in numbers
- 99.9% known-malware block rate.
- 99.7% phishing block rate.
- 99.2% reduction in phishing that reaches the user's inbox.
These figures are Check Point's official performance claims. In the field, we transparently note that every environment is different and results vary with configuration and traffic patterns. In our pilot deployments — in a typical Turkish Microsoft 365 environment of 500–2,000 users — we see the additional threat catch rate, with Check Point running on top of Defender, land between 15% and 30% within the first 30 days.
5. The Kinetik Bilişim Approach — How Do We Work?
Our typical flow with a Microsoft 365 customer:
- Free Field Audit (1 week): We analyze the SPF, DKIM, DMARC, and BIMI configuration for the existing domain. We clarify which Defender level your Microsoft 365 license actually provides.
- Check Point Free Trial (14 days): Zero risk. Your existing email flow never changes. We deploy it in monitor mode only — never touching the inbox — to report the attacks that slipped through. At the end of 14 days, you see a list reading "these 47 emails are the attacks Defender missed but Check Point caught."
- Production rollout: We evaluate the trial results together. The decision is yours. If you want to proceed, we purchase a license sized to your scale (Advanced Protect or Complete Protect) and switch to detect & remediate or inline mode.
- Ongoing management: As an optional managed service, we analyze DMARC reports, fine-tune Check Point policies to your industry, and update policy against new attack vectors.
Two certifications underpin this process as a core assurance:
- Check Point Advanced Partner 2026 — authorization to provide direct technical support in Türkiye.
- Check Point Email Solution Specialization — official expertise accreditation for Check Point's Email & Collaboration product.
Frequently Asked Questions
I have a Microsoft 365 E5 license — do I still need Check Point?
E5 includes Defender for Office 365 Plan 2, the most comprehensive Microsoft protection level. Even so, the architectural limits described above still apply — an extra layer adds value in internal phishing, sophisticated BEC, and quishing. In a 14-day free trial we can see together how many additional threats Check Point catches in your existing E5 setup.
Will Check Point Harmony Email change my existing Defender configuration?
No. It connects via the Graph API. Your MX record doesn't change, and your existing Microsoft policies keep working as is. Check Point runs as an additional inspection layer — side by side, not on top of.
Is there an issue with KVKK obligations in Türkiye?
Check Point Harmony Email processes only metadata (the security status of a file, sender/recipient information, threat verdicts). Email content and files remain in the customer's own Microsoft 365 tenant. We jointly put in place the data-processor agreement required for KVKK and GDPR compliance.
How long does it take to go live?
The API connection is typically completed within 15–30 minutes. Fine-tuning policies to your environment and settling reporting flows takes the first 7–14 days. The production-mode transition (inline blocking) usually happens within 14–21 days.
Does the free trial automatically become paid at the end?
No. At the end of the 14-day trial, if you want to continue we start the active-license purchase process together; if you don't, the Check Point connection is removed and your Microsoft 365 environment returns to its original state. It's a transparent, pressure-free process.
Does it really catch BEC attacks? What can AI do against social engineering?
Classic rule-based engines struggle with BEC — that's true. Here Check Point works with an AI engine that learns correspondence patterns: by modeling a CFO's writing style with a CEO over the past six months, the vocabulary used, and typical file types, it flags deviations. Contextual signals such as "the display name resembles the CEO, but you've never corresponded on this topic before" are the foundation of this engine.
What Should You Do Now?
If your company uses Microsoft 365 or Google Workspace and you've seen at least one suspicious email in the past 12 months, it's worth taking a concrete step to measure what your current protection actually catches.
We offer two free options:
- Field Audit (1 week): We ask nothing of you in terms of setup. We provide a report summarizing your domain's SPF/DKIM/DMARC/BIMI status, your Microsoft 365 license level, and open risks.
- Check Point Harmony Email Free Trial (14 days): In monitor mode, without touching any of your email, we report the attacks Defender let through.
Schedule an intro meeting — in a 30-minute conversation we listen to your environment and decide together which option makes sense for you.
About this article: Kinetik Bilişim is the Türkiye partner of Check Point Software Technologies at the Advanced Partner 2026 level and holds the Email Solution Specialization accreditation. The field observations in this article are drawn, in anonymized form, from email-security audits we have carried out for mid-sized and large Microsoft 365 and Google Workspace customers in Türkiye. No details belonging to any specific customer case have been shared.
The definitions of BEC, quishing, ATO, and zero-day URLs in this article align with the MITRE ATT&CK framework and international IETF protocol standards. Check Point Harmony Email & Collaboration performance data is based on Check Point Software Technologies' official 2026 product documentation.
