Why Your Microsoft & Google Security Defaults Are Not Enough

Over the last decade I have spent working in cybersecurity, and in the last year alone deploying Lumora X across more than 20 startups and SMBs in the UAE, I have seen one pattern repeat itself again and again: the companies that get hit the hardest by cybersecurity threats aren’t lacking in tools at all. They already have Microsoft 365, or Windows Defender running. A lot of them use Google Workspace with its own built in security defaults as well.  

On the surface, the setup looks acceptable. Everything from MFA to spam filtering and admin controls exist, seemingly functional and secure on the dashboard. But that is usually where the trouble starts. For SMBs, this is not a theoretical risk, with 1 in 3 surveyed SMBs having faced a major cyberattack with damages amounting to anywhere between USD $250,000 on average and up to $7,000,000 in the worst-case scenario.  

That is the part many teams miss. Native controls are useful and, in many cases, they are better than people give them credit for. But they still need configuration, policy decisions, and regular review after day one. In this blog, I’ll walk you through what Microsoft 365, Defender, and Google Workspace cover by default, where those defaults fall short in real SMB environments, and what a proper security baseline should look like if you want more than a clean dashboard and a false sense of security.

‍

What Defaults Actually Cover

Microsoft 365 and Google Workspace are built for usability. That makes sense. A business should be able to sign up, create users, start sending email, and share files without needing a security engineer in the room for every step.

That is why security defaults usually cover the following basic settings:

• MFA prompts at a general level  

• Standard spam and phishing filtering  

• Default sharing permissions  

• Baseline access controls  

For a small business with no in-house security team, these feel practical. The main issue is that a real business does not stay in "default mode" for long. It only takes a few months for the environment to look very different from the one the defaults were meant to support, with the real problems starting once the business moves beyond the original setup.

‍

Why That Becomes a Security Problem

Most breaches in SMB environments do not start with attackers breaking advanced controls. In many cases, they walk through gaps that were never closed. That is why I keep coming back to the same point: the problem is not the native tool. The problem is leaving it unmanaged after setup.

‍

Mistakes I Keep Seeing

• A tenant has MFA enabled, but legacy authentication is still open.
• Windows Defender is present, but endpoint settings are left close to stock configuration.
• External forwarding is allowed when it should not be.
• Mailbox rules are not reviewed.
• Admin roles stay too broad.
• Audit logging exists somewhere in the background, but nobody is checking it with any regularity.

None of these looks dramatic during setup, and that is exactly why they get missed. Right up until one compromised account, one malicious OAuth approval, or one bad forwarding rule turns into a much larger problem. The controls existed, but the configuration never reached the level the business needed.

‍

Where Microsoft 365 and Google Workspace Leave Gaps by Default

This is where I usually ask businesses to slow down and look at what is actually enabled, not what they assume is covered.

A lot of SMBs in the UAE are already on Microsoft 365 or Google Workspace. They assume the platform’s native protections are doing most of the heavy lifting. Some protections are there, yes. But there are still gaps that stay open unless someone goes in and configures them properly.

‍

Microsoft 365 and Defender

Microsoft gives businesses a strong starting point. I do not see the platform itself as the issue, but the main problem is that many of the controls that matter in a real operating environment still need to be switched on, tuned, or enforced properly.

Attack surface reduction rules: These controls help block common attacker behaviour across endpoints, including script abuse, suspicious child processes, and macro-driven activity. In many Microsoft environments, they are still left off because nobody wants to deal with the testing and rollout effort.

Safe Links and safe attachments: A lot of businesses assume email protection is fully in place because they are already using Microsoft 365. That is not always true, as these controls are not enabled by default in every plan and - even where they are available - they still need policy-level setup.

Audit logging: Logging is one of the first things I check. In some environments, businesses assume audit visibility is already there across the board. It often is not configured to the level they need, and in some tiers it is not available in the way they expect. If logging is weak, incident review becomes guesswork.

Legacy authentication: This is still one of the most common gaps. If older authentication methods remain open, attackers have a path around stronger sign-in controls. MFA loses value when a weaker door is still unlocked.

‍

Google Workspace

Google Workspace creates a different kind of false confidence. It is clean, easy to deploy, and very startup-friendly. That simplicity is useful. It also makes it easy for teams to assume security is already in good shape because the admin side does not feel complex. However, there are some common gaps to keep in mind:

No native EDR: Google Workspace does not give businesses a native endpoint detection and response layer in the same way some Microsoft-led environments expect. That means endpoint visibility depends on separate tooling. If a laptop is compromised, the business may not have the depth of telemetry it thought it had.

Default external sharing settings: This is a big one. File sharing can stay broader than the business intended, especially once teams start collaborating with agencies, vendors, consultants, or clients. Over time, that creates quiet exposure around links, folders, and sensitive documents.

Admin console security controls that ship unconfigured: Google does provide useful admin-side controls, but many of them still need active setup, review, and policy decisions. If nobody goes past the default state, the business ends up with a functioning platform, but not a hardened one.

‍

What a Real Security Baseline Looks Like

A security baseline is where the conversation becomes practical. It means the environment is configured according to how the business works, not according to how the vendor ships the platform. For SMBs, that does not always mean buying more tools. In many cases, it means taking the tools already in place and hardening them properly.  

Therefore, a useful baseline should usually cover four key areas:

1. Identity Enforcement: Every user should have MFA. Admins should have stronger methods where supported, including phishing-resistant options. Legacy authentication should be blocked. Session controls should be reviewed. Break-glass accounts should exist, and they should be documented and monitored.

2. Email and Collaboration Controls: Email is still one of the easiest routes into an SMB environment. That means allow-lists need review. External forwarding should be restricted. Mailbox rules should be monitored. Internal threat detection should be enabled. Collaboration settings should be checked with the same seriousness as email filtering.

3. Access and Sharing: Least privilege sounds simple until you review a live environment. Then you find users with old permissions, contractors who still have access, project-based sharing links that never expired, and admin roles that grew because nobody wanted to slow down operations.

4. Monitoring and Visibility: If logging is weak, alerts are poorly tuned, or no one is reviewing activity, the business is left guessing. You cannot rely on guesswork once accounts, endpoints, email, and domains are all connected to daily operations.

‍

Conclusion

Security defaults may be enough on day one, but they fall behind as your business scales up. Most SMBs do not need more tools; they need the ones they already have to be configured and maintained properly.

That is where Lumora fits into the equation.

Lumora build a baseline that provides essential security with clarity which reflects how businesses actually operate. Then we keep reviewing it, because that is the only way to stop defaults from turning into blind spots six months later.

If you are using Microsoft 365 or Google Workspace and have never properly reviewed what essential security options are still running in default mode, this is a good time to check. Lumora’s 72-hour essential security review gives you a clear picture of what is configured well, what has drifted, and what needs fixing first.  

Book an assessment