Need help with recommendations following our 2nd ransomware attack

We need some help locking down our O365 machines/environment as for the second time a successful attack was made against an organization I just started supporting. If was traced back to one user that had access to company wires. Their mail box was full of email forwards as well to non-related company's.

We are implementing DMIC, DMARC and SPF records right away and I will run it through MXToolbox.

We are going to subscribe to KnowBe4 to get the employees …

access attack back box cybersecurity down email environment machines mail non o365 organization ransomware ransomware attack recommendations