Attack Coverage
Attackers move fast. A phishing kit can steal a fully MFA-approved Microsoft 365 session and replay it from a dozen home internet connections before anyone looks, and a compromised administrator can plant an app that outlives a password reset. Fluency ships detections for the attacks hitting organizations right now — named campaigns and the techniques behind them, mapped to MITRE ATT&CK, and delivered to every Fluency instance automatically.
Latest coverage
Newest first.
| Date | Coverage | Attack type |
|---|---|---|
| October 23, 2026 | Teams helpdesk impersonation — catches the Teams chat from a throwaway outside tenant that comes seconds before the call, whatever name the attacker uses, and the installer downloaded from a throwaway Azure host. | Social engineering, remote access |
| October 20, 2026 | Storm-2755: AiTM session theft — catches the proxied sign-in, the replayed session and the mailbox activity that follows. | Session theft, phishing |
| October 20, 2026 | Storm-2372: device-code phishing — catches tokens approved on a real Microsoft page and then used from somewhere else. | Phishing, token theft |
| October 20, 2026 | Identity persistence and privilege abuse — rogue federation trusts, federated credentials, elevated access and privileged role grants. | Persistence, privilege escalation |
| October 20, 2026 | MFA fatigue and password attacks — push bombing, MFA fraud reports, brute force and stolen passwords stopped at Conditional Access. | Credential attacks |
| October 20, 2026 | Business email compromise — adds detection of the oddly named inbox rules attackers use to hide replies. | Business email compromise |
| October 19, 2026 | Storm-3119: app-based tenant takeover — follows one rogue app from permissions to secrets to password resets. Shipped five days after Microsoft's disclosure. | Cloud takeover |
| October 13, 2026 | Deeper Entra ID visibility — Entra ID sign-in and audit logs through Azure Event Hubs, including non-interactive sign-ins, and an AI investigation report on every escalated case. See the October 2026 Platform Update. | Identity |
| July 2025 | AI Assist — every behavior alert is triaged by AI before an analyst sees it. See AI Assist. | All |
| May 2025 | Threat intelligence — AlienVault OTX indicators, refreshed daily, matched against incoming events. See the release notes. | Known-bad infrastructure |
| 2021 | Business email compromise — mailbox forwarding, delegation, Send As, inbox rules and OAuth consent grants. | Business email compromise |
Browse by attack type
- Session theft — Storm-2755: AiTM session theft
- Phishing and token theft — Storm-2755: AiTM session theft, Storm-2372: device-code phishing
- Social engineering and remote access — Teams helpdesk impersonation
- Cloud tenant takeover — Storm-3119: app-based tenant takeover
- Persistence and privilege escalation — Identity persistence and privilege abuse, Storm-3119: app-based tenant takeover
- Credential attacks — MFA fatigue and password attacks
- Business email compromise — Business email compromise, Storm-2755: AiTM session theft
Why Fluency catches what others miss
Behavior, not single events. A stolen session looks like an ordinary sign-in. An app permission grant looks like ordinary administration. Fluency's strongest detections follow one session, one user or one app across sign-in and audit records for hours or days, and alert only when the whole attack pattern appears — so they stay quiet on normal activity and fire on the real thing.
From disclosure to detection in days. When Microsoft disclosed Storm-3119 on October 14, 2026, Fluency's detection for it was running on customer instances by October 19. New detections are built from the threat research behind each campaign, tested by replaying real attack data, and published as soon as they are ready.
Nothing to install or tune. New detections reach every Fluency instance within about two hours of release, with no configuration. If the data is flowing, the coverage is on.
Every alert investigated. AI Assist triages every behavior alert before an analyst has to, closing the ones that need no action and explaining why. Every case it escalates arrives with an AI investigation report built from the raw events.
One ticket per problem. Fluency's patented risk scoring groups related behaviors by the user or entity they belong to, so an attack that trips five detections becomes one prioritized case, not five alerts.
Mapped to MITRE ATT&CK. Every threat page lists the ATT&CK tactics and techniques it covers, and an AI client connected through Fluency's MCP server can map your own cases to ATT&CK — for example, which techniques were more prevalent this month than last.
See it in your environment
- Try Fluency free for 30 days. Sign up at trial.ingext.io/signup, connect Microsoft 365, and the detections on these pages start working on your data.
- Book a demo at fluencysecurity.com/demo.
- Already a customer? These detections are already on your instance. To get the most from the identity coverage, connect Entra ID, through Azure Event Hubs or Microsoft Graph, and the Microsoft 365 audit log.