The Daily Gloss
Loading…
Ask Gloss AI
Runs on Cloudflare Workers AI against today's aggregated Gloss data — not raw MCP access. It can be wrong or incomplete; verify anything before acting on it.
Accounts & services under attack · last 7 days
- Loading…
Brute-force (many failures against one account), password spray (one IP hitting many accounts), NetSuite auth failures, and risky service principals over the trailing week. Click "show evidence" for the counts, IPs, and countries behind each.
Geolocation concerns · impossible travel, VPN, foreign sign-ins
- Loading…
Impossible travel = two sign-ins too far apart in too little time for any flight. VPN/Tor and foreign (non-US) sign-ins are shown alongside Entra ID Protection's own detections. Click "show evidence" for the exact locations, IPs, times, and distance math behind each.
Top 5 concerning communications
- Loading…
Built from DLP policy matches, insider-risk alerts, phishing verdicts, and email-tone analysis — metadata about what tripped a policy, not message content. Click "show evidence" on any item for the exact underlying data.
Risky identities & open security flags
- Loading…
Threat activity
- Loading…
Security posture
Top 5 · needs attention first
- Loading…
Ranked by lowest composite. Behavior score (gloss swatch) reflects email tone, not activity volume — shown only where computed.
Early warning · watch list
- Loading…
Trending down over the last two weeks but not yet at coaching threshold — the point to catch things early with a casual check-in.
Coaching conversations
- Loading…
Signals are conversation-starters, not verdicts. OOO and disabled accounts are excluded automatically; verify context with managers before acting.
Prism alerts
- Loading…
Inbox rules auto-forwarding to an external address — checked only on today's coach/watch/risky targets, not the full roster.
Departments
License waste · recoverable seats
- Loading…
Premium SKUs (Power BI Pro, Copilot, E5, etc.) held by accounts with no activity signal in the trailing window. Verify before reclaiming — new hires and leave-of-absence accounts show up here too.
Contracts stuck unsigned
- Loading…
DocuSign envelopes sent but not completed after 7+ days — revenue and legal exposure sitting in someone's inbox.
T&E spend velocity · this month vs last
Top 5 Concur spenders · week & month
New hires · last 30 days
Departures · last 30 days
Star performers · top composite, 7-day signals
- Loading…
Business pulse · yesterday
Top 5 products · across all brands, trailing 7 days
Daily brief email · recipients
Everyone on this list gets the daily brief automatically at 8:00 AM ET. Recipients are BCC'd on the send.
Send brief now
Sends today's already-generated brief immediately via Microsoft Graph. Doesn't add anyone to the recurring list above.