Phishing Simulation Reveals Gaps in Defender Coverage
A 900-user company runs Microsoft Defender for Office 365 Plan 1 and Microsoft Defender for Endpoint Plan 1. The security team runs an internal phishing simulation. Results: 14 percent of users clicked the link, and 9 users entered credentials on the simulated landing page. The team wants to know what would have happened in a real attack and what controls are missing. They also learn that a finance workstation downloaded a malicious file that executed and made outbound connections to an unfamiliar IP address. Endpoint investigation shows the file ran, and the analyst can see the alert but cannot run an automated investigation or use advanced hunting queries. Leadership asks whether to buy Plan 2 upgrades for both products or to invest in user training instead.
1. Map each observed gap to the specific capability that is missing, and state which plan upgrade addresses it.
Read the worked answer
Three distinct gaps appear, and they do not all point to the same purchase.
Credential entry on a simulated page: the users who submitted credentials need to be identified and remediated. Attack simulation training is a Defender for Office 365 Plan 2 capability; Plan 1 provides protection features such as Safe Links and Safe Attachments but not the full simulation and training experience. However, the click and credential-entry data itself is a training signal, not a product failure.
Malicious file executed on the finance workstation: Defender for Endpoint Plan 1 provides next-generation protection and attack surface reduction but not automated investigation and response or advanced hunting. Those are Plan 2 capabilities. The analyst's inability to run automated investigation or hunting queries is direct evidence of the Plan 1 ceiling.
The alert was visible but not contained automatically. Plan 2 adds automated investigation and remediation, which is the capability that would have isolated the device and removed the artifact without waiting for an analyst.
2. Give a recommendation that responds to the leadership question, treating the purchase as a risk decision rather than a binary choice.
Read the worked answer
Frame the decision around what each investment changes.
Training changes the probability that a user clicks or submits credentials. It does not change what happens after a malicious file executes, and 14 percent click rates will never reach zero. The executed file is the higher-severity event because it produced outbound connections, which suggests command-and-control activity, and it happened despite existing endpoint protection.
Defender for Endpoint Plan 2 is the stronger immediate buy: automated investigation and remediation plus advanced hunting directly address the gap the analyst hit. Defender for Office 365 Plan 2 is justified if the organization wants built-in attack simulation training and the additional protection features, but a third-party training program can cover the awareness gap at lower cost.
Recommendation: upgrade Endpoint to Plan 2 first, run a time-boxed evaluation of Office Plan 2 against the simulation and training requirement, and continue user training in parallel. Do not present training as a substitute for detection and response capability.