Typically engaged when: BEC incident or phishing wave.
IT Director
BEC incident or phishing wave
Project engagement
Defender for Office 365 P1/P2