The October 8 Integrity Tech advisory describes China-linked operators using exploitation, Exchange password attacks, VPN persistence, and automated email collection. Patching closes a real opportunity. It does not establish that passwords, existing application grants, or another exposed service cannot reach the same data.
The engineer finishing the patch window may not own identity exceptions or mailbox permissions. An attacker is less constrained by the ownership spreadsheet.
Pick one recently patched public service. Bring its identity and mail owners into the review; check password-only access, existing grants, and what a foothold could collect. Keep urgent patching and test the residual routes separately.
The analysis does not assume attackers can switch routes freely.