Think your email has been compromised? Not sure what to do next?
We investigate Microsoft 365 and Business Email Compromise incidents to establish what happened and what needs to happen next. We also help organisations strengthen their Microsoft 365 security before an incident occurs.
Supporting businesses, MSPs, legal professionals and incident response teams.
WHAT WE DO
WHEN SOMETHING HAS HAPPENED
Investigate
Establish what happened, when it happened, what the attacker accessed and the extent of the compromise.
BEFORE SOMETHING HAPPENS
Strengthen
Review your Microsoft 365 environment, identify security weaknesses and receive clear, prioritised recommendations.
Business Email Compromise
Investigation of account compromise, fraudulent emails, payment diversion and attacker activity.
Microsoft 365 Investigations
Detailed analysis of sign-ins, mailbox activity, email access, rules, permissions and other Microsoft 365 evidence.
Digital Forensics
Forensic examination of computers, accounts and digital evidence to establish activity, timelines and impact.
Microsoft 365 Security Review
Review of your Microsoft 365 security configuration to identify weaknesses and provide clear, prioritised recommendations.
Incident Response
Support to contain the incident, establish scope and inform the next steps.
Forensic Reporting
Clear, evidence-based reporting explaining what happened, the supporting evidence and recommended next steps.
WHY SANDPIPER
Microsoft 365 Specialists
Deep platform knowledge, not generic incident playbooks.
Rapid Response
Decisive, proportionate support when time is critical.
Clear, Actionable Reporting
Technical findings translated into focused next steps.
Evidence-Led Approach
Conclusions grounded in the available evidence, not assumptions.
ABOUT SANDPIPER
Sandpiper Forensics provides specialist Microsoft 365 security and digital investigation services without unnecessary complexity. Whether responding to an active incident or reviewing an organisation's security before something goes wrong, our focus is simple: understand the evidence, explain the findings clearly and provide practical recommendations.
CONTACT
Speak to an investigator.
If you’re facing a suspected compromise or need independent digital evidence expertise, begin with a confidential conversation.
enquiries@sandpiperforensics.com