Email, contractors and remote access at a professional-services firm
A 2,000-person professional-services firm runs Microsoft 365 as its primary platform and has 400 contractors on unmanaged laptops who access client folders through a VPN concentrator that is three firmware revisions behind. Remote staff hairpin all traffic through headquarters, and the resulting latency has driven roughly 30 percent of them to install browser extensions that proxy their traffic. In the last quarter the firm recorded three business email compromise incidents traced to QR-code phishing that bypassed the mail gateway, one account takeover that persisted for nine days, and a six-terabyte transfer of client material to personal cloud storage by a departing manager. The firm has endpoint protection from another vendor and no SASE. The managing partner wants a proposal in ten working days and has asked which single purchase would reduce risk most.
1. The managing partner asks for one purchase. Argue what should come first over a 30-day horizon, and what you would refuse to buy yet.
Read the worked answer
Refuse the premise that one purchase carries the answer, but still give a ranked first move, because the partner has to spend something.
The first move is email and collaboration protection, because all three BEC incidents and the account takeover began there, and because it protects contractors and partners on unmanaged devices where endpoint agents cannot be installed. An API-based deployment into Microsoft 365 is the right model here: it sits behind the existing mail gateway rather than replacing MX records, sees internal mail and file-sharing events that a gateway never inspects, and needs no change to user behaviour. That directly addresses QR-code phishing and post-compromise internal traffic.
Second, and cheap, revoke the VPN client's unchecked access and force multi-factor authentication with number matching; three BEC events and a nine-day takeover suggest session hygiene, not tooling, is the weak point. Third, close the egress visibility gap: the six-terabyte transfer was invisible, so data-loss controls and SaaS discovery matter more than another perimeter appliance.
Defer the full SASE purchase for one quarter. It is likely correct for the hairpin problem, but choosing a vendor before you know what the browser extensions are doing risks buying a proxy for traffic that is already being proxied elsewhere.
2. Compare replacing the mail gateway with a cloud email security service against deploying an API-based layer alongside it. Which fits this firm, and what does the choice change operationally?
Read the worked answer
A gateway replacement changes the MX record: all inbound mail flows through the new service first, and it becomes the primary verdict for inbound delivery. It gives clean ownership of inbound filtering, easy quarantine reporting and one console, but it inspects mainly inbound mail and it is a cutover with a rollback window. Internal mail, file-sharing notifications and post-delivery malicious edits remain outside its view unless the product also connects via API.
An API-based layer connects to the Microsoft 365 tenant with read and remediate permissions. It sees inbound, outbound and internal messages, detects compromised accounts by their internal sending pattern, and can pull a message out of mailboxes after delivery. It sits behind the existing gateway, so the gateway still sets the initial verdict and the two must be tuned together to avoid duplicate quarantine and confused users.
For this firm the API-based layer is the better fit: the incidents were internal and post-delivery in nature (QR-code phishing that passed the gateway, a nine-day takeover), and the unmanaged contractor population makes anything agent-based impractical.
Operationally the choice shifts work: fewer MX and DNS changes, more attention to tenant permissions, detection tuning and a clear rule about which console owns quarantine decisions.
3. Describe what Harmony SASE would and would not solve here, and how you would measure success after 90 days.
Read the worked answer
It would solve three things cleanly. Remote and contractor users stop hairpinning through headquarters, because web, SaaS and private-application access are brokered from the cloud with identity-aware policy; that removes the latency that pushed users towards third-party proxy extensions. Private application access replaces the ageing VPN concentrator with per-application rather than network-level access, which shrinks the blast radius of a stolen contractor credential. And it gives visibility of which SaaS applications are actually in use, which is the precondition for controlling the personal-storage transfers.
It would not solve the endpoint problem: unmanaged contractor laptops can still copy client material to local storage or an unmanaged USB device, and SASE sees the network path, not the file system. It does not replace the email control described earlier, because mail delivered inside the tenant never crosses the SASE edge. It also will not stop a determined user installing another proxy, though it removes the motive.
Measure after 90 days: share of remote sessions brokered rather than hairpinned; median latency for the top five SaaS applications; count of proxy or anonymiser extensions reported on managed devices; number of private applications still reachable over network-level VPN; and volume of uploads to unsanctioned storage destinations, trending down.