The Daily Gloss
Ask Gloss AI
Runs on Cloudflare Workers AI against today's aggregated Gloss data — not raw MCP access. It can be wrong or incomplete; verify anything before acting on it.
Star performers · top composite, 7-day signals
- Loading…
Accounts & services under attack · last 7 days
- Loading…
Brute-force (many failures against one account), password spray (one IP hitting many accounts), NetSuite auth failures, and risky service principals over the trailing week. Click "show evidence" for the counts, IPs, and countries behind each.
Geolocation concerns · impossible travel, VPN, foreign sign-ins
- Loading…
Impossible travel = two sign-ins too far apart in too little time for any flight. VPN/Tor and foreign (non-US) sign-ins are shown alongside Entra ID Protection's own detections. Click "show evidence" for the exact locations, IPs, times, and distance math behind each.
Top 5 concerning communications
- Loading…
Actual flagged excerpts (subject + body preview) — ONLY messages containing profanity or threat language (lexicon-matched; marketing/bulk senders excluded), plus DLP snippets and phishing catches. Medium/high only. Tone scans cover today's coach/watch/risky targets and read RECEIVED mail, so excerpts are messages a person received, not wrote. Teams chat and SMS content aren't exposed by current integrations. Click "show evidence" for the full excerpt and metadata.
Risky identities & open security flags
- Loading…
Threat activity
- Loading…
Security posture
Early warning · watch list
- Loading…
Trending down over the last two weeks but not yet at coaching threshold — the point to catch things early with a casual check-in.
Prism alerts
- Loading…
All users with an inbox rule auto-forwarding/redirecting to an external address. The org-wide scan rotates a batch of mailboxes each morning (get_inbox_rules is per-user), covering the full enabled population every ~10 days; findings persist here for 30 days, so the list accumulates to full coverage.
License waste · recoverable seats
- Loading…
Premium SKUs (Power BI Pro, Copilot, E5, etc.) held by accounts with no activity signal in the trailing window. Verify before reclaiming — new hires and leave-of-absence accounts show up here too.
Top 5 Concur spenders · week & month
New hires · last 30 days
Departures · last 30 days
Business pulse · yesterday
Top 5 products · across all brands, trailing 7 days
Daily brief email · recipients
Everyone on this list gets the daily brief automatically at 8:00 AM ET. Recipients are BCC'd on the send.
Send brief now
Sends today's already-generated brief immediately via Microsoft Graph. Doesn't add anyone to the recurring list above.