GLOSS · LBP

Edition of — · loading


Today’s read

The Daily Gloss

Loading…

Under attack

Brand sales · yesterday

Full written brief
Loading…
Ask anything

Ask Gloss AI

Summarize today's biggest risk Who improved the most this month? Any pattern in the geolocation concerns?

Answers via the Requesty gateway (Cloudflare Workers AI as the fallback) over today's aggregated Gloss data; "Deep analysis" additionally makes read-only live pulls from the MCP fleet. It can be wrong or incomplete; verify anything before acting on it.

Good news · business

Business pulse · yesterday

Loading…
Good news · business

Top 5 products · trailing 7 days

Loading…
Good news

Star performers · top composite, 7-day signals

Streak = consecutive scoring runs as a star, ending with this run. Runs are weekdays, so a weekend or holiday is not a break; "≥" means the streak spans the whole 120-day window.

People · needs attention

Early warning · watch list

A two-week trend at or below the watch threshold, not yet at coaching threshold — the point to catch things early with a casual check-in.

Critical · security

Accounts & services under attack

Each finding states its own window. Brute-force (many failures against one account) and password spray (one IP hitting many accounts) come from Entra's interactive sign-in feed, which is capped at 1,000 rows and so covers hours, not days — window loading…. Multi-country bursts come from Advanced Hunting (24h), NetSuite auth failures from its login audit (7 days), and risky service principals from Entra's current list. Click "show evidence" for the counts, IPs, and countries behind each.

Critical · security

Geolocation concerns · impossible travel, VPN, foreign sign-ins

Impossible travel = two sign-ins too far apart in too little time for any flight. VPN/Tor and foreign (non-US) sign-ins are shown alongside Entra ID Protection's own detections. Window: loading…. Click "show evidence" for the exact locations, IPs, times, and distance math behind each.

Cost & hygiene

Top 5 Concur spenders · week & month

Loading…
Cost & hygiene · workforce

New hires · last 30 days

Loading…
Cost & hygiene · workforce

Departures · last 30 days

Loading…
Tools

Daily brief email · recipients

Loading…

Everyone on this list gets the daily brief automatically at 8:00 AM ET. Recipients are BCC'd on the send.

Tools

Send brief now

Sends today's already-generated brief immediately via Microsoft Graph. Doesn't add anyone to the recurring list above.

Daily board

Org trend · monthly composite

Loading…
Daily board

30-day trend · workforce & security

Loading…
Daily board

Pipeline health · last 14 runs

Loading…
Live data pull · security review

DNSFilter

Loading the week's threat picture…

Open the tab to load…
Top threats

Threat domains by severity · tap a row for its evidence

Open the tab to load…
Who to follow up

People and devices with threat blocks

Open the tab to load…
Filter evasion

DoH, VPN and proxy lookups

Open the tab to load…
Agent coverage

Roaming agents

Open the tab to load…
Daily threat trend

Threat-flagged blocks per day

Open the tab to load…
Context, not threat rankings
Acceptable-use & policy blocks

Blocked categories

Open the tab to load…
Breadth of blocking · any category

Devices by blocked domains

Every blocked domain of any kind, mostly ads and DoH retries. This is not a threat ranking; see Who to follow up.

Open the tab to load…
Most-requested domains · all traffic

Top 15 by requests

Open the tab to load…