Hybrid attacks span across on-premises and cloud environments, targeting multiple layers of an organization's infrastructure. They compromise identity across Active Directory and Entra ID, move through on-prem servers and endpoints, and land in Microsoft 365. Entra ID is the single identity plane beneath M365. Copilot now draws on that M365 data every day, which widens the attack surface. Native retention policies and recycle bins were never built to recover from attacks like these.