In July 2025, Microsoft disclosed a critical vulnerability known as ToolShell (CVE-2025-53770), rated 9.8 out of 10 on the severity scale (where 10 is the most dangerous possible). This vulnerability affected all supported versions of SharePoint On-Premises: SharePoint Server 2016, 2019, and Subscription Edition.

What made this particularly alarming was that attackers didn't need a password or any prior access to your system. If they could reach your SharePoint server, they could get in.

Before Microsoft could fully patch the issue, more than 400 organisations globally had already been compromised, including US government agencies. Chinese state-sponsored threat actors were among those identified, alongside ransomware groups who exploited the same vulnerability for financial gain.

That was 2025. In 2026, the attacks have continued.

SharePoint is not just a file storage system. For many organisations, it is the central nervous system of the business, holding sensitive documents, running workflows, storing employee data, and connecting to other Microsoft services like Teams, Outlook, and OneDrive.

When an attacker gets into SharePoint, they don't just see your files. They can:

•  Move laterally across your entire Microsoft environment

•  Access sensitive business and personal data

•  Install backdoors that persist even after patches are applied

•  Deploy ransomware across your network

•  Steal credentials and impersonate trusted users

And here is the part that should concern every business leader most: you may not know it has happened. These attacks are designed to be quiet. By the time you notice something is wrong, the attacker may have been inside your systems for weeks or months.

If you answered yes to the first question and no to any of the others, your organisation is carrying unnecessary risk.

This is not a moment for a committee to review and report back in 30 days. The following actions need to be on your IT team's desk this week:

We are not here to tell every organisation to move to the cloud. There are legitimate reasons (regulatory requirements, data sovereignty, legacy integrations) why some organisations must keep SharePoint On-Premises.

But the security overhead is real and growing. Every critical vulnerability that Microsoft patches in the cloud automatically means nothing to an on-premises customer who hasn't applied the update. The responsibility sits squarely with your IT team, and the window between disclosure and exploitation is shrinking.

And then there is the end-of-life reality. SharePoint Server 2016 and SharePoint Server 2019 both reach end of support on 14 July 2026, just 90 days from now. After that date, Microsoft will release no further security patches for either version. Any vulnerability discovered after July 2026 will remain permanently unpatched on those platforms. If you are running SharePoint Server Subscription Edition, you are not affected by this deadline — it remains supported with no fixed end date. But if you are on 2016 or 2019, the options are clear: migrate to SharePoint Online, upgrade to SharePoint Server Subscription Edition, or accept an ever-growing security exposure with no vendor safety net.

If you are running On-Premises purely out of habit, inertia, or because it has always been that way: the clock is no longer just ticking. It has nearly run out.

There's a version of this conversation that happens after an incident. After a breach. After data has been exfiltrated, or systems have been locked down by ransomware, or a client calls asking why their data appeared somewhere it shouldn't.

That conversation is expensive. Remediation is expensive. Reputational damage is expensive. Regulatory exposure (especially under POPIA) can be very expensive.

A penetration test, run proactively, finds the same problems before they become incidents. It's the difference between fixing a lock and explaining to your clients why their data is gone.

We've seen it go both ways. Businesses that test regularly catch things early and fix them quietly. Businesses that don't, often find out the hard way — and at the worst possible time.

The typical approach looks something like this: open the Microsoft Defender portal, see a list of recommendations, pick the ones worth the most points or that seem easiest, and start implementing.

Three months later, your score has barely moved. Or it moved briefly and then dropped back down. Or you've spent weeks on improvements that broke critical workflows and had to be rolled back.

The problem isn't lack of effort. It's lack of strategy.

Effective Secure Score improvement requires understanding three things most teams skip:

Get any of these wrong and you'll spend more time fixing problems than you saved by implementing the recommendation.

This pattern repeats across every recommendation in your Secure Score. What looks like a configuration change on the surface requires strategic thinking about business impact, technical dependencies, and change management.

IT teams often start with "quick wins"—recommendations that promise high point values with supposedly minimal effort.

The problem is that "quick" depends entirely on your environment's current state and complexity. Blocking legacy authentication might take 15 minutes in one organization and require weeks of application modernization in another.

More importantly, chasing points without understanding impact leads to a dangerous pattern: implementing changes that raise your score but don't actually improve your security posture in meaningful ways for your specific risk profile.

The organizations that successfully improve their Secure Score don't focus on quick wins first. They focus on right wins—improvements that align with their actual threat landscape and business priorities, regardless of point value.

Join our security analyst, Kyle Farr, on 10th of February 2026 for a live demonstration of strategic Secure Score improvement:

• Current state analysis - How to assess your score breakdown and identify what actually matters for your risk profile (not just point values)
• Prioritization framework - The decision criteria for determining which recommendations to tackle first based on business impact and technical dependencies
• Live implementation walkthrough - Watch a real security control get configured with proper testing and rollback planning
• Monitoring and sustainability - Building the processes that catch drift before it degrades your security posture
• Q&A for your specific challenges - Get answers about your environment's blockers and constraints

MOVEit Transfer (2023): In May 2023, the CLOP ransomware gang exploited a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software's MOVEit Transfer application. By the end of 2023, the attack had compromised more than 2,700 organizations and exposed approximately 93.3 million personal records, with total damages estimated at $12.15 billion. High-profile victims included British Airways, the BBC, Shell, the U.S. Department of Energy, and numerous universities. This breach highlighted the critical importance of rapid vulnerability patching and the devastating consequences of zero-day exploits.

AVTECH IP Cameras (2024): In August 2024, security researchers discovered an unpatched vulnerability in AVTECH IP cameras used in critical infrastructure was being exploited to spread Mirai malware, despite the vulnerability being known since 2019. This five-year delay in addressing a known vulnerability put essential services at risk.

Office of the Comptroller of the Currency (2025): In early 2025, the U.S. OCC identified suspicious interactions between a system administrative account and internal user mailboxes—activity that had gone undetected for months, raising concerns about the agency's visibility into its systems and the effectiveness of its logging practices. This breach at a federal financial regulator highlighted how even government agencies struggle with monitoring gaps.

AT&T Breach (2022-2024): AT&T confirmed a significant data breach involving unauthorized access to its Snowflake cloud storage environment. The breach occurred between May 1, 2022, and October 31, 2022, but wasn't detected until April 2024—a detection delay of nearly two years. The breach exposed over 86 million records, including Social Security Numbers. This prolonged detection window allowed attackers extensive time to access and potentially monetize sensitive customer data.

Without effective monitoring and logging, suspicious activity can go undetected, giving attackers more time to exploit vulnerabilities and exfiltrate data.

Prevention:

• Implement centralized logging and real-time monitoring solutions
• Regularly analyze logs for anomalies
• Set up automated alerts for suspicious activity
• Establish baseline behavior to detect deviations

Pen Test Role: Pen testers attempt to bypass detection and exfiltrate data to identify gaps in monitoring systems and incident response processes.

Coinbase (2025): In May 2025, Coinbase confirmed a breach when cybercriminals bribed overseas support staff to leak sensitive customer data, including names, birthdates, email addresses, and partial Social Security numbers. Attackers used this data to orchestrate highly targeted social engineering attacks against customers. This breach highlighted the vulnerability of outsourced operations and the human element in security, demonstrating that even financial incentives can compromise insider threats.

Google Salesforce Breach (2025): In August 2025, Google confirmed a data breach from a compromised Salesforce-hosted corporate database. The hacking group ShinyHunters gained access through social engineering by impersonating IT support staff and tricking a Google employee into approving a malicious application. Even at tech giants with sophisticated security teams and trained personnel, social engineering remains remarkably effective.

Workday Breach (2025): On August 18, 2025, Workday disclosed a data breach stemming from a social engineering campaign where threat actors impersonated HR or IT staff. They contacted employees by phone or text to trick them into granting access to a third-party CRM platform. This demonstrates the evolving sophistication of social engineering tactics and the importance of verification procedures for access requests.

Humans are often the weakest link in cybersecurity. Attackers use phishing, pretexting, impersonation, and other social engineering tactics to manipulate employees into granting access.

Prevention:

• Conduct ongoing security awareness training
• Simulate phishing campaigns regularly
• Implement multi-factor authentication and verify requests for sensitive actions
• Establish clear protocols for verifying identity before granting access
• Create a culture where employees feel comfortable questioning suspicious requests

Pen Test Role: Pen testers simulate phishing attacks and social engineering scenarios to assess employee awareness and identify weak points in organizational security culture.