Applied ML04 Jun 2026 · 10 min read
Why we stayed single-model on the LLM layer — and what we built instead
One good model in a 20-detector consensus beats two models carrying 60% of the verdict.
— VaultFuzion ML TeamRead the article →
Engineering Blog
Build notes, threat research, and architecture decisions.
Long-form write-ups of the architectural decisions behind each shipped release — what we built, why we chose one approach over another, and what happened when it met production traffic. New articles land here after the release they describe is live.
Threat Research21 May 2026 · 9 min read
The attacker took their credentials on Tuesday. Our detection fired on Wednesday because it had to.
An account-takeover case study, and the identity-to-email signal bridge that closed the gap.
— VaultFuzion Threat ResearchRead the article →
Compliance08 May 2026 · 14 min read
What audit logs need to become before a court will treat them as evidence
Audit logs are not evidence. The difference between the two is a cryptographic chain, a legally-operative custodian record, and a destruction record that is itself audit-chained and independently verifiable.
— VaultFuzion ComplianceRead the article →
Engineering07 May 2026 · 8 min read
Why we shipped three native SIEM connectors instead of one webhook
Detection quality is a function of what a SIEM can ingest, not what a vendor can POST.
— VaultFuzion EngineeringRead the article →
Compliance07 May 2026 · 6 min read
Why every VaultFuzion tenant now sees an A-F POPIA grade on their dashboard
Compliance scores have a problem: a number on its own does not tell you whether you are above or below the line. A letter does.
— VaultFuzion EngineeringRead the article →
M365 Backup07 May 2026 · 7 min read
Microsoft 365 native retention vs evidence-grade backup: a 2026 guide for South African MSPs
Where Microsoft's built-in retention stops, what falls through the gap, and what an MSP actually needs to defend a POPIA Section 22 event.
— VaultFuzion EngineeringRead the article →
M365 Backup07 May 2026 · 6 min read
Item-level point-in-time restore: recovering single emails, files, and SharePoint list items
Whole-mailbox restore is the disaster-recovery answer to a granular problem. The threats most MSPs face in 2026 need a different unit of recovery.
— VaultFuzion EngineeringRead the article →
AI Email Security07 May 2026 · 7 min read
The 4.5× AI phishing multiplier: what Microsoft's 2025 Digital Defense Report means for MSPs
Click-through rates went from 12% to 54% in a single product cycle. Detection has not kept pace. What MSPs actually need to layer in.
— VaultFuzion Detection EngineeringRead the article →
AI Email Security07 May 2026 · 6 min read
Behavioural BEC detection: why static rules fail against modern business email compromise
The CEO-fraud playbook is no longer typos and Hotmail addresses. Pattern matching against known-bad signatures lost the engagement in 2024.
— VaultFuzion Detection EngineeringRead the article →
Cross-Product07 May 2026 · 6 min read
Cross-product threat correlation: when dark-web credential intel meets email and SaaS-posture detection
The compromise-first, phish-second pattern is the modern attack chain. Defenders who watch only one signal at a time are seeing one frame of a film.
— VaultFuzion Platform TeamRead the article →
Cross-Product07 May 2026 · 6 min read
From identity risk signal to email containment: closing the BEC loop
Credentials stolen on Tuesday, mailbox accessed on Wednesday, BEC sent on Thursday. The 22-second handoff is the new asymmetry — and the bridge between identity and email is how MSPs close it.
— VaultFuzion Platform TeamRead the article →
Entra ID07 May 2026 · 6 min read
Conditional Access What-If: simulating Entra ID policy changes before they break production
Microsoft Entra Conditional Access is a power tool with a sharp edge. Production is the wrong place to learn how the edge works.
— VaultFuzion Identity EngineeringRead the article →
Entra ID07 May 2026 · 5 min read
Detecting impossible travel and token replay: beyond the Microsoft Defender baseline
Defender's identity protection covers the basics. The advanced patterns — token replay, brute-force-at-scale, federated-domain spoofing — need a layer above.
— VaultFuzion Identity EngineeringRead the article →
Pricing07 May 2026 · 7 min read
Microsoft 365 backup pricing for South African MSPs: what global vendors charge, what local vendors charge, and the gap that no marketing page mentions
USD-denominated SaaS, 15% VAT, R/USD volatility, plus the "global" premium. The real M365 backup bill for a SA MSP rarely matches the marketing landing page.
— VaultFuzion Product TeamRead the article →
Pricing07 May 2026 · 5 min read
Entra ID protection pricing: why MSPs pay $250 a month per tenant — and what SA-resident vendors charge instead
Identity threat detection, drift, license analytics, conditional-access What-If. The global price is broken; SA-resident pricing is roughly a third of that.
— VaultFuzion Product TeamRead the article →
Compliance07 May 2026 · 13 min read
Why South African data residency stopped being a checkbox in 2026
POPIA Section 72, where master keys actually live, and what data residency means when the regulator asks for proof.
— VaultFuzion ComplianceRead the article →
AI Email Security06 May 2026 · 15 min read
Thirteen engines, one verdict: how consensus detection finds what single-model security misses
Single-classifier email security has a blind spot in every direction it does not look. Consensus across thirteen independent engines, plus DMARC AI in the same chain, closes the seams.
— VaultFuzion Detection EngineeringRead the article →
Entra ID05 May 2026 · 14 min read
Backing up Entra ID is not the same as protecting it: a four-tier architecture for identity resilience
Microsoft's native Entra Backup and Recovery covers a useful baseline. There is still a gap above that baseline — drift, simulation, cross-tenant operations, identity threat correlation — that an MSP at scale has to fill some other way.
— VaultFuzion Identity EngineeringRead the article →
Pricing04 May 2026 · 14 min read
The price of a stack: when adding vendors stops adding value
Stack consolidation is sold as cost savings. Sometimes that is true. Sometimes it is a lock-in trade dressed as a discount. The honest answer requires per-seat math, MCS-floor disclosure, and a clear view of where integration boundaries actually break.
— VaultFuzion Product TeamRead the article →