Find Compromised Accounts in Your Hospital's Microsoft 365, Before Attackers Use Them
FoundationDx is a specialist detection service for hospitals and health systems. We analyze your Microsoft 365 and Duo sign-in and mailbox activity, catch the account takeovers, password sprays, and email compromise that blend into normal traffic, and hand your team a short, prioritized Action Plan every day.
- Live at a multi-hospital health system
- 3.5M events analyzed daily
- Email content is never read
- Works alongside your existing tools
What We Do, in 30 Seconds
Most security tools tell you that something happened. FoundationDx tells you which accounts actually need attention today, why, and what to do next.
What it is
A detection layer that reads your Microsoft 365 and Duo activity logs and learns how each person normally signs in and sends mail, so it can spot the accounts that have stopped behaving like their owner.
What you get
A daily Action Plan in work order: the most likely compromises at the top, each with where to look and the steps to contain it. Low-risk noise stays out of the way.
What it isn't
It's not a rip-and-replace. FoundationDx doesn't replace your SIEM, Microsoft Defender, or Duo. It makes the data those tools already collect far more useful.
If You Searched for Help, It Was Probably Because of One of These
These are the situations healthcare IT and security teams bring to us most often.
- "We have MFA everywhere, and attackers still got into a mailbox."
- "A staff account sent phishing to half the hospital, and we heard about it from the recipients."
- "Our sign-in logs show a password spray, but we can't tell whether any of it succeeded."
- "We get thousands of alerts a day and no way to know which accounts are actually compromised."
- "We're a small team with no data scientists, and manual log review takes days."
- "Leadership asked how we'd know if an account was taken over, and we didn't have a good answer."
Healthcare Collects Huge Amounts of Security Data. Very Little of It Gets Read.
Hospitals generate millions of authentication and email events across Duo, Microsoft 365, EMRs, and network infrastructure. Attackers count on one more sign-in not standing out.
- Stolen-credential sign-ins look like ordinary logins
- Alert fatigue buries the few alerts that matter
- Manual log review is slow, incomplete, and hard to staff
- IBM Security & Ponemon Institute, Cost of a Data Breach Report 2026.
- Vectra AI, 2023 State of Threat Detection Report (survey of 2,000 SOC analysts), as reported in Security Magazine, July 26, 2023.
- IBM Security & Ponemon Institute, Cost of a Data Breach Report 2024, as summarized by Enzoic.
From Raw Logs to a Daily Action Plan in Three Steps
No data science team required. We do the heavy lifting.
Use the data you already have
FoundationDx works from the Microsoft 365 sign-in and mailbox activity you already collect, plus Duo authentication logs if you use Duo. Mail is analyzed from metadata only. It runs as a managed service from FoundationDx's own servers or secure cloud-based servers.
Every account gets its own baseline
Machine learning, adaptive rules, and per-user behavioral baselines run side by side. Each account is compared with its own history (a rolling 60-day learning window) and with the rest of your organization.
Your team works the Action Plan
Findings that corroborate each other are ranked first. Each item says what was found, where to look, and what to do, sized to your team's daily capacity.
Account Compromise Doesn't Always Look Sudden
Some attacks break a user's pattern overnight. Others change it so gradually that no single day looks wrong. A tool built around one detector tends to catch only one of these. FoundationDx watches for both, on every account.
Abrupt change against recent behavior
Compares each account against its own recent history and flags sharp breaks within the reporting window.
- Sign-in from a new country, device, or blocked network
- A burst of failed sign-ins followed by a success
- A mailbox that suddenly starts sending unusual mail
Gradual change against the long-term baseline
Each step is small enough to stay under a normal alert threshold, and a short-term baseline quietly moves along with it. Comparing against the long-term baseline exposes the cumulative change.
- Access gradually widening to new systems or records
- Working hours, locations, or volumes slowly shifting
- Privileges or data movement creeping up week over week
Stronger together: corroborating signals
Each detector on its own is a partial view. When a slow drift on an account lines up with a sudden sign-in anomaly or an authentication finding, FoundationDx raises that account's priority. A single weak signal stays a low-priority review item. Your team sees fewer false alarms, and the quiet, long-running compromises that single-detector tools miss get surfaced.
This Is What Your Team Would Get Every Morning
Below is a Daily Action Plan from a live FoundationDx deployment at a multi-hospital health system, with counts redacted. It's a short, ordered work list, not a dashboard you have to interpret.
Findings surfaced in a single day's Action Plan:
- HighSuccessful sign-ins from a tenant-blocked network
- HighHigh-confidence attack combinations on individual accounts
- HighPassword spray followed by an attacker-shaped success
- MediumUnusual outbound mail with no sign-in evidence
- MediumPhishing campaigns grouped by sending infrastructure and subject themes
- MediumCredential attacks stopped by MFA or lockout, password already known
| # | Priority | Finding | Where | Action | Comment |
|---|---|---|---|---|---|
| 1 | High | 🚫 BLOCKED NETWORK — account(s) with a successful sign-in from a tenant-blocked ASN | User Priority Queuetop of the queueanalyst report ↗ | Confirm with the user; if unexplained, reset credentials and revoke sessions. Check how the sign-in got past the block (which control, which path). | Counted within the critical accounts. The source address, application and time are in the account's finding. |
| 2 | High | CRITICAL — account(s) with a high-confidence attack combination | User Priority Queuetop of the queueanalyst report ↗ | Confirm the adversarial combination per account and contain as needed. | Highest-deviation first. Then check the campaign / org-wide panels for a shared root cause. |
| 3 | High | 💦 SPRAY SUCCEEDED — account(s): failures during a tenant-wide spray followed by an attacker-shaped success | User Priority Queue💦 spray hit taganalyst report ↗ | Reset credentials, revoke sessions and tokens, review registered MFA methods and mailbox rules, check what the session accessed after the success. | Held in today's list regardless of capacity — work right after fused and critical. |
| 4 | High | 🔐 CREDENTIAL ATTACK → SUCCESS — account(s) | Credential-Attack Failure Burstscritical rowsanalyst report ↗ | Confirm with the user; if unexplained reset the password, revoke sessions and tokens, review MFA methods and inbox rules. | Not deduplicated against spray-succeeded — an account can appear in both. |
| 5 | Medium | MAILBOX SENDING — account(s) with unusual outbound mail, no sign-in evidence | User Priority Queuetagged 📤 mailbox sendinganalyst report ↗ | Scan for silent external Bcc and high fan-out first; review sent items only where the sending is out of character for the person. | A review list, not incidents, and not counted in Priority Users. Tagged 📤 in the queue. A critical sign-in pair on any of these promotes it to FUSED RISK. |
| 6 | Medium | PHISH TARGETED — account(s) targeted, no takeover evidence | Campaign Pairssending infrastructure & subject themesanalyst report ↗ | Work as ONE campaign: identify the sending infrastructure and subject themes in the Campaign panel, block/quarantine at the mail gateway, brief the affected users. | Exposure, not compromise — not cases and not counted in Priority Users. Open an individual investigation only if an account later shows sending evidence. |
| 7 | Medium | 🔐 CREDENTIAL ATTACK HELD — account(s), password guessed or known, MFA / lockout stopped it | Credential-Attack Failure Burstshigh rowsanalyst report ↗ | For MFA-denied rows reset the password (it is known); for spray rows block the source IPs. Confirm the user did not trigger it. | Exposure, not compromise. A later success from an unfamiliar network escalates the row to CRITICAL on the next run. |
| 8 | Medium | 💦 SPRAY TARGETED — account(s) with failed authentications and no success evidence | Organization-Wide Signalssource IPs / ASNs, then Campaign Pairsanalyst report ↗ | Work as ONE campaign from the Org-Wide / Campaign panels: block the source IPs/ASNs at the identity provider or firewall, confirm smart-lockout and MFA held, re-run after containment. | Exposure, not compromise — not cases and not counted in Priority Users. Tagged 💦 sprayed in the queue. A later success escalates the account automatically. |
| 9 | Medium | Population / temporal — population-velocity (shared-infrastructure spray / credential-stuffing) signal(s), plus temporal first-seen / slow-drip / rising-trend signals — a volume that is not individually reviewable and mostly reflects ordinary churn; scan only the top rising trends | Population & Slow-Drip Anomaliesanalyst report ↗ | Review alongside the headline finding; check whether they share a root cause. | Secondary to the headline finding. |
| 10 | Low | Today's list — account(s) (SOC capacity 50): the fused, critical and spray-succeeded accounts above, then the highest-scoring | User Priority Queuetoday's list above the divideranalyst report ↗ | Work the list to completion. | The phish-targeted account(s) are outside this count (campaign line above). |
Microsoft 365 Threats FoundationDx Detects
FoundationDx analyzes Microsoft 365 sign-in and mailbox activity through a set of purpose-built detectors. Each one targets a different way accounts are attacked or misused, and each account is measured against its own history and against the rest of your organization.
Password Spray, Brute Force & Credential Stuffing
Attempts to guess, stuff, or spray passwords, whether fast or deliberately slow.
- Wrong-password bursts against an account, with routine MFA prompts and Conditional Access blocks filtered out so the real attempts stand out
- MFA pushes denied after a correct password, genuine account lockouts, and sign-in attempts on disabled accounts from unfamiliar networks
- Password spray across many accounts, including slow spray from a single source spread out over time to avoid lockouts
- Distributed campaigns that rotate through hundreds of IP addresses at one or two attempts each, too thin for per-IP thresholds to catch
- A credential attack or spray that ends in a successful sign-in
Suspicious Sign-In Locations & Impossible Travel
Where a sign-in comes from, and what kind of network is behind it.
- A successful sign-in from a network your organization has blocked, a sign the block was bypassed
- Sign-ins through Tor exit nodes (refreshed daily from the Tor Project's published list), VPNs, or cloud-hosting providers
- First-time country, state, or city for a user compared with their own history
- Impossible travel between two successful sign-ins
- A new IP address or network provider appearing for a user
Account Takeover & Insider Behavior Change
Changes in how a user works, whether sudden or building up gradually.
- Off-hours activity, judged against each user's own typical working hours
- Gradual drift, where a user's sign-in patterns move away from their long-term baseline one small step at a time
- Profile shifts, where a user's overall pattern of behavior changes substantially
- Combinations never seen before for that user, such as a new network paired with a successful sign-in
- First use of new applications, admin portals, or operations
Organization-Wide Attack Campaigns
Patterns that only appear when you look across every account at once.
- The same IP address and client suddenly reaching many accounts (shared attack infrastructure)
- Attack infrastructure tracked by network provider, so rotating IP addresses doesn't hide it
- A new app or resource path appearing across many users at once, a common sign of consent phishing or lateral movement
- Patterns never seen anywhere in your organization, flagged the first time they appear
- Low-volume activity that keeps recurring or slowly grows over many days, even though no single day crosses a threshold
Business Email Compromise (BEC) & Phishing
Mailbox behavior analyzed from message metadata. Message content is never read.
- External senders using the display name of someone inside your organization
- Look-alike sender domains and first-contact external senders
- Payment or urgent subject lines paired with new external recipients, and attachments from senders never seen before
- A mailbox that suddenly starts sending: spikes in volume, recipients, or recipient domains, and new external domains
- Silent external Bcc, outside replies inserted into internal threads, and off-hours sending
- The same lure reaching multiple mailboxes as a coordinated campaign
Why Healthcare Teams Add FoundationDx
We are not a broad AI platform. We are purpose-built to find compromised accounts in complex healthcare environments, and to make that finding easy to act on.
Answers, Not More Alerts
You get a ranked work list sized to your team's capacity, not another stream of alerts that exhausts your staff.
Learns Each User
A rolling behavioral baseline (for example, a 60-day learning window) adjusts as each person's normal activity changes.
Several Detectors, One Verdict
Machine learning and configurable rules run together, and agreeing signals raise an account's priority so real compromises rise to the top.
Privacy-Conscious by Design
Email is analyzed from message metadata only. Message content is never read.
Fast, Flexible Deployment
Available as a managed service from FoundationDx's own servers or secure cloud-based servers, with minimal overhead and rapid time to value.
Built for Healthcare Scale
Designed for organizations with high data volume but limited internal security or AI staff. We do the heavy lifting.
Good. FoundationDx is a specialist layer that makes your existing security investments smarter in healthcare — not a competitor, but a force multiplier.
Built for Healthcare Organizations Running Microsoft 365
FoundationDx is a good fit if your organization generates a lot of authentication and email activity and needs faster, clearer answers than your current tools give you.
- Health systems and hospitals
- Critical access facilities
- Healthcare IT and cybersecurity teams
- Organizations with high data volume but limited internal security or AI staff
See What's in Your Data with a Pilot
You don't need a long-term commitment to find out whether FoundationDx is useful. Start small, see real findings from your own environment, then decide.
Share a Defined Dataset
Provide a scoped dataset from your environment. We handle the rest.
We Find the Real Risks
Our platform surfaces the compromised accounts and anomalies hidden in your data.
You Get Clear Findings
Receive an Action Plan with recommendations you can act on immediately.
No heavy lift. No unnecessary complexity. We reply within one business day.
Questions People Ask Before They Talk to Us
If yours isn't here, send it to us.