Find out
Read-only. We see what’s on, off and half-done, and tell you which of the four promises you can already make.
You keep that answer either way.
Microsoft Security Optimisation
You’ve spent the
money on security. Do you feel any safer?
You already own most of what you need to be a hard target. We make sure it’s actually reducing your risk, and show you the evidence, so when the board asks “how exposed are we?” you can answer with something better than “we think we’re fine”.
What you’ll be able to say at the end
-
“Here’s where we’re exposed, here’s what we’ve reduced, and here’s what’s left.”For the board
-
“Here’s the evidence.” What was on, what we changed and whyFor the insurer and the auditor
-
“Nothing broke.” Piloted first, watch-only before enforced, rolled back if neededFor your IT team
-
“We’d know if it slipped.” Secure Score, control coverage and outstanding findings, with an owner, checked monthlyFor you
Founded by a Microsoft MVP for Security
Nearly 30 years in IT, 20 in security
Cyber Essentials certified business
Built on years of seeing what works, and what doesn’t, in real Microsoft environments
Read client references →
Sound familiar?
None of this means you’ve been careless. Microsoft gave you a lot of locks. Nobody has had time to check which doors they’re on.
- The board asks “are we secure?” and the honest answer is “we think so”.
- The insurance renewal asked twenty questions and you weren’t sure about half.
- You had a near miss. Everyone was shaken. Nothing really changed.
- You’ve paid for the premium licence for two years and couldn’t say what it’s doing.
IDENTITY FIRST
Where we strengthen identity.
A stolen password on its own gets an attacker far less.
We start from what you already own. Every Microsoft 365 setup is different, so we work through these areas using the controls your licences support, and years of seeing what works, and what doesn’t, in real environments. Each step reduces what a stolen password can do. None of it makes you breach-proof.
Today (example)EXAMPLE
Conditional Access
Block legacy authenticationReport-only
MFA for all usersReport-only
Compliant or hybrid-joined deviceReport-only
ExclusionsUndocumented
How people sign in
AdminsSMS code
Everyone elseSMS or voice
PasskeysOff
FIDO2 security keysOff
Admin rights
Global Administrators8 standing
Other admin rolesPermanent
Admin accountsSame as email
Access reviewsNever
After (example)
Conditional Access
Block legacy authentication✓ On
MFA for all users✓ On
Compliant or hybrid-joined device✓ On
Exclusions✓ Owner, review date
How people sign in
Admins✓ Passkey or key
Everyone else✓ Passkey
Passkeys✓ Enabled
SMS and voice✓ Retired
Admin rights
Global Administrators✓ 0 standing
Other admin roles✓ Just-in-time
Admin accounts✓ Separate
Access reviews✓ Quarterly
Drag the orange handle, or focus it and use the arrow keys
A Conditional Access baseline
Sensible rules for who can sign in, from where and on what.
- Legacy sign-in blocked, and MFA for everyone, with phishing-resistant MFA for admins where your devices and licences support it.
- Only compliant or hybrid-joined devices reach company data, and with Entra ID P2, risky sign-ins are challenged.
- Report-only first, then enforced, so we see the impact before anyone is locked out.
Sign-ins checked against your policies, and every exception owned
Passkeys and phishing-resistant MFA
Signing in with a face, fingerprint or PIN instead of a code a fake page can steal.
- Passkeys in Microsoft Authenticator or FIDO2 security keys, which a fake login page can’t capture.
- Admins first, then everyone, in waves your helpdesk can support.
- SMS and voice codes retired where possible, because they’re the easiest to steal.
Faster sign-in for staff, and nothing for a phishing page to capture
PRIVILEGED ACCESS
One compromised admin shouldn’t put your whole Microsoft 365 setup at risk.
No one walks around with the keys to everything.
In most organisations, too many people hold permanent admin rights, often on the same account they use for email. Compromise one of them and an attacker holds the keys to everything.
No PIM? It needs Entra ID P2. Where it isn’t licensed, we still reduce standing admins with separate admin accounts, fewer role holders and regular reviews.
- With PIM: admin roles eligible, approved and time-bound
- Separate admin accounts
- Break-glass accounts monitored
- Regular access reviews
Standing Global Admins
LAYERED DEFENCE
One phishing email. Six layers in its way.
One bad email is far less likely to turn into a bad week.
Today, most organisations have one or two of these layers working. We work through all six, depending on your licences and setup, using tools you already own. No single layer is perfect. Together they make an attack much harder.
EXAMPLE
WHAT YOU CAN SAY
ALL PANELS ARE EXAMPLES
Four things you’ll be able to say about your business.
Nobody can promise you’ll never be breached. What you can have is a much harder target. Each of these is configured, tested and documented.
Identity
“If someone steals a password, it gets them a lot less than it used to.”
If a password is stolen, the damage is much smaller.
- A password alone isn’t enough to take an admin account, however good the phishing was.
- Unmanaged devices are kept away from company data. A home PC with a saved password gets very little.
- Nobody holds standing admin rights, so one stolen account is far less likely to become every account.
Devices
“Every device is enrolled, configured and checked against the baseline.”
A lost or stolen laptop is far less of a worry.
- Every laptop and server enrolled and protected by Microsoft Defender, not just the ones in the spreadsheet.
- Security baselines and endpoint policies applied, with attack surface reduction rules tested in audit mode first.
- Gaps closed and written down: what was off, what we changed and why.
Email and sharing
“Email and sharing are set up properly, and we can show it.”
Fewer convincing fakes reach your team, and files are far less likely to wander.
- Defender for Office 365 preset policies applied: Safe Links, Safe Attachments and impersonation protection.
- SPF, DKIM and DMARC moved to enforcement, so it’s much harder to send email pretending to be you.
- Sharing defaults and sensitivity labels configured, so files go to named people by default.
Cloud
“Every Azure subscription has the right Defender plan, and the findings go to a person.”
Your cloud systems get the same care as your laptops.
- Everything you run in Azure is on a list, including what was set up in a hurry.
- The systems your business depends on are properly watched, and the test box isn’t costing a fortune.
- Alerts are routed to a named person or your SOC, not a dashboard nobody opens.
JOINED UP
Everything you run, one picture.
When something happens, you see the whole story in one place.
Every Microsoft security product watches one part of your business. Defender XDR joins them up, so one suspicious sign-in can lead to action on the device, the mailbox and the account as a single incident. That’s what Defender does. Our job is making sure each part is configured to feed it.
One incident, handled together.
Why it matters: when the laptop, the mailbox and the login all report to the same place, one suspicious sign-in can isolate the device, block the sender and reset the password as a single incident. Separately, they’re alerts nobody connects.
EXAMPLEHow it runs
Careful, tested, and nothing switched on without warning.
Fix, carefully
Pilot group first. Watch-only before enforce. Help desk briefed.
Nothing changes for everyone at once, and every step can be undone.
Keep it that way
Your team gets the runbook and owns Secure Score, control coverage and outstanding findings.
It stays fixed because it’s now somebody’s job.
Quarterly check if you want us watching for drift.
Questions people ask us
Straight answers, in plain English. Every organisation is different, so the details depend on your setup.
Will this disrupt staff?
Very little, by design. Changes go to a small pilot group first, and new rules run in watch-only mode before they’re enforced, so we see the impact before anyone is affected. Your help desk is briefed before each step, and every change can be undone.
Do we need new licences?
Usually not. We start from what you already own and use the controls your licences support. If a licence change would genuinely help, we’ll say so and explain why, but we don’t sell licences, so we’ve no reason to push one.
How long does it take?
It depends on your setup and how much is already in place. The read-only first look typically comes first, and we agree the order and pace of changes with you from there, in steps your team can support.
What do we get at the end?
A clear record of what was on, what we changed and why, the evidence to show your board, insurer or auditor, and a runbook so your team can keep it that way. If you’d like, we can check in quarterly for drift.
What if something breaks?
Every change is tested on a pilot group first, in watch-only mode where possible, and can be rolled back. If something unexpected happens, we pause, fix it and only carry on when it’s right.
Ask us the question you’d ask your IT team. How exposed are we, really?
Thirty minutes. No jargon.
Tell us what keeps you up at night and what licences you’ve got. We’ll tell you which of the four you can already say, and whether you need us for the rest.
Book a 30-minute callPick a time that suits you