Is Someone Already Reading Your Email?

Most email break-ins go unnoticed for weeks. The Microsoft 365 Intrusion Check tells you, in less than a week, whether an attacker is in your account right now or has been at any point in the past six months.

Flat fee: $875 for organizations up to [10] users (larger organizations quoted on the call)
Fast: about two weeks, start to finish.
Private: we never read your emails or files
One time: not a subscription

Connect with us

How Email Break-Ins Actually Happen

Attackers don’t break in. They log in, using a stolen password or a login session hijacked from a fake sign-in page. To Microsoft 365, it looks like any normal login.

Then they watch. They learn who approves invoices, who your bank contact is, and how your team writes. When the timing is right, they redirect a payment. Most organizations find out only after the money is gone, and by then the attacker has usually been inside for weeks or months.

Why Microsoft’s Built-In Alerts Miss It

Microsoft 365 mostly watches where a login comes from. Attackers know this. They use services that make them look like they’re logging in from your own town, or stolen session tokens that skip the password and MFA prompt entirely.

The real warning signs show up in what an account does after it logs in:

A hidden rule that forwards finance emails to an outside address
A filter that hides replies from your bank before anyone sees them
A login from a network that has never touched your account before

That’s exactly what we look for.

What You Get

Six months of history, not just activity from the day we connect
Detection of common attacks: stolen passwords, hijacked sessions, fake login pages, password-guessing attempts, and suspicious forwarding or inbox rules.
Disguised logins flagged: we spot connections made to look local
Behavior review: what each account actually does, not just where it logs in from
Clear results: a plain-language written report and a live walkthrough with your leadership

What We Never Look At

Not wanting an outside firm reading your email is a fair concern, especially if you handle donor records, grant files, or client matters. We share it.

We never open:

Email messages or attachments
SharePoint or OneDrive files

We only review activity records: sign-ins, mailbox settings, forwarding rules, connection details, and basic message information (sender, recipient, time, and subject line).

A note on subject lines: A subject line can mention a donor, a grant, or a case name. If that concerns you, raise it on the fit call before you authorize anything.

Why this works: A hacked account gives itself away by how it behaves, not by what’s written in it.

What This Is Not

Not ongoing monitoring. It’s a one-time check. If you want continuous coverage afterward, we’re happy to talk about it.
Not cleanup. If we find an attacker, removing them is a separate project. We’ll tell you plainly what it involves and what it costs.
Not a full security or compliance audit. The narrow focus is what keeps it fast and affordable.
Not a guarantee. A clean report means we found no signs of a break-in. No method catches everything, and we won’t pretend otherwise.

How It Works: 4 Steps, About 2 Weeks

Fit call (15 minutes). We confirm this is right for you, explain what we will and won’t look at, and quote your price. Nothing is accessed yet.
Sign the agreement. We send a short written scope with the fee and terms. Once it’s signed, we schedule your start.
Connect and scan. You approve our detection tool in Microsoft 365 using a Global Administrator login. We send step-by-step instructions and offer a free guided session. You have up to 15 days to do this. The scan then runs 7 to 10 days, and nothing else is needed from you.
Review the results. We walk your decision-maker through the written report. If we found nothing, you have documented proof. If we found something, you’ll know what it is and how serious it is before the call ends.

Two Must-Haves

We’d rather you know these now than find out halfway through.

Global Administrator access. It’s required to connect our tool, and there’s no workaround. If you, or whoever manages your Microsoft 365, can’t grant it, we can’t run the check.
Your decision-maker at the results review. This is the person responsible for security risk, such as your executive director, owner, or principal, and not necessarily your IT contact. If we find a problem, they’ll be the one making the next call.

Quick Checklist Before You Book

You use Microsoft 365 (not Google Workspace or basic POP/IMAP email).
You have Global Administrator access, or can reach whoever does.
If an outside IT provider manages your Microsoft 365, they’ll need to cooperate.
Your decision-maker must attend the results review.
You understand this check finds problems but doesn’t fix them.
If you store regulated data (HIPAA health information, CUI, or similar), you’ll mention it on the fit call.

Why OptfinITy

Since 2002, OptfinITy has helped small businesses and nonprofits across the country, with deep roots in the DC and Northern Virginia region.

You’re not just paying for a scan. You’re paying for an expert who will tell you honestly what we found and what to do next.

Find Out Before a Wire Transfer Tells You

Know whether someone is inside your email, while there’s still time to act.