yMussel
A silent alarm inside your Microsoft 365 — the tripwire that fires on command.
Most break-ins today don’t look like break-ins. An attacker phishes a password or steals a sign-in token and is now inside your Microsoft 365 as a valid, logged-in user — and your existing security sees a normal login.
yMussel plants a decoy in your tenant — a fake administrator account that looks completely real but that no employee ever has a reason to touch. The instant anyone touches it, you get an alert — what happened, from where, and when. Because a real person never touches the decoy, every alert is real.
Every alert is real
A decoy has no legitimate reason to be touched, so there are no false alarms to tune or wade through.
It proves itself
Fire a test alert on demand and watch it land in seconds. A real touch is detected within minutes, and a monthly check confirms the tripwire is still armed.
Read-only, by design
yMussel only reads the sign-in activity needed to watch the decoy. It makes no changes to your tenant and never reads your mail, files, or documents.
How it works
yMussel works by deception. We place a decoy account in your Microsoft 365 tenant that looks like an ordinary account but that no employee has any reason to use. Using Microsoft’s own sign-in activity — read-only — yMussel watches for any sign that the decoy has been touched and alerts you the moment it is. Because a legitimate user never touches it, every alert is real.
What the engagement looks like
- You grant read-only access to your Microsoft 365 sign-in activity — a standard consent screen. No passwords change hands, and yMussel can never make changes to your tenant.
- We set it up for you — your coverage goes live with nothing for your team to install, run, or maintain.
- You get alerts the moment it’s touched, and a regular note that it’s healthy.
What it is — and isn’t. yMussel is a tripwire, not a firewall. It doesn’t replace your other security; it catches the intruder your other tools miss once they’re already inside and looking around — the exact gap that has no other reliable alarm.
Need the technical detail? We’re glad to walk MSPs and security teams through the architecture, the exact permissions requested, and how data is handled — with deeper specifics shared under NDA.