Blog
News, research and updates from the Attic team
Have IVON investigate one of your own Defender alerts
Of the 165 Defender XDR alerts that came in across thirteen beta environments in July 2026, 71.5 percent fell into the two lowest threat levels. Exactly the layer that gets left. From today you can have one of them investigated, free.
Attic launches IVON: agentic MDR from European soil for SMBs on Microsoft 365
Attic Security launches IVON, a security agent that triages, investigates and contains identity signals on Microsoft 365 on its own. Dutch software, European data, under European law.
What is Agentic MDR?
Agentic MDR investigates and acts on security signals on its own, instead of only alerting. What it is, and why SMBs on Microsoft 365 benefit from it.
Attic adds Google Workspace thanks to ECCC
Thanks to the ECCC grant, in Netherlands called CIF-NL, we can start building Attic for Google Workspace.
Why LLMs Hate Fake Data: The Evolution of Our Context-Aware Token Proxy
We built a token proxy for our AI SOC analyst that pseudonymizes sensitive data before it reaches Claude. Here is how naive regex broke LLM reasoning, and how context-preserving pseudonymization fixed it.
Rik van Duijn · Ethical Hacker 
DSD Europe expands security portfolio with Attic Security for Microsoft 365
Rosmalen, February 10, 2026 — DSD Europe expands its security portfolio with Attic Security, a Dutch cybersecurity solution purpose-built for MSPs.
Attic Security and M365Permissions partner for better Microsoft 365 access management and security
Attic Security and M365Permissions are partnering up to give organisations full visibility into access permissions within Microsoft 365 and Azure environments.
How we recovered 21k after helpdesk fraud
Episode 4 of SCAM ALERT covered an IR case I worked back in 2021. Now that it is public, here is the full technical post-mortem of what actually happened — and how we got the money back.
MSP Show brings MSPs from across the Benelux together
MSP Benelux is organising the MSP Show on September 16 at Jaarbeurs Utrecht. Managed Service Providers from across the Benelux will come together at this event.
The financial impact of a cyberattack: a realistic look for SMBs
Discover the cost of cyberattacks for SMBs and learn how prevention protects your business against severe financial damage.
RSAC 2025 - Saasified Crime: AiTM on the Rise
Video recording of talk by Rik van Duijn and Wesley Neelen titled Saasified Crime: AiTM on the Rise during RSA Conference 2025.
Attic is Cybersecurity Made in Europe
Thanks to our finalist spot at the ECSO STARtup awards in The Hague, Attic Security now carries the Cybersecurity Made In Europe label.
AiTM for WHFB persistence
Learn how we managed to circumvent \"phishing-resistant\" MFA based on Windows Hello for Business, during an internal capture-the-flag competition.
Phishing for Refresh Tokens
Recently I did the \"Offensive Entra ID (Azure AD) and hybrid AD security\" training during which Dirk-jan did a demo where he used a modified EvilGinx phislet to
DevOps access is closer than you assume
tldr: Azure DevOps can be accessed using multiple 1st party client ids, allowing anyone to pivot from a stolen session to access the repositories. When we speak
FastHTTP bruteforce attack: more than 50% of organizations targeted
Yesterday we conducted research among users of the Sentinel add-on for Attic M365. We investigated the impact of a large-scale bruteforce attack targeting Microsoft 365.
Watch back: AiTM session at CyberSec NL
On November 6 and 7, CyberSec Netherlands took place at the Jaarbeurs in Utrecht. I gave a talk titled "AiTM: How Criminals Circumvent MFA". The recording is now on YouTube.
Release Notes 2024.5.0
These are the Release Notes for Attic Security release 2024.5.0. First fully multilingual version of Attic supporting English and Dutch.
With Attic, NEH delivers an even more secure Microsoft 365 workplace to housing associations
Attic and NEH, the market leader as IT provider for housing associations, have joined forces in a strategic partnership to significantly improve security.
Protect your Microsoft tenant against phishing attacks
Today we added a new check and fix to Attic Microsoft 365 Premium that lets you protect your Microsoft tenant against phishing attacks.
Setting up a SOC: start small, but aim for the jackpot
If you are setting up a SOC function, follow the NCSC factsheet. But here are two key additions for organizations using Microsoft 365.
Attic Release 2023.12.0
With this release we're launching Attic as an affordable and straightforward SOC-as-a-Service, powered by Microsoft Sentinel!