Skip to main content
SearchEnquiry basket

Security

Security work that closes the gaps that actually get exploited

Security posture assessment, identity hardening, endpoint protection and incident readiness.

Discuss this serviceRequest a quotation

The problem

Most organisations that suffer a breach were not defeated by a sophisticated adversary. They were compromised through a credential without multi-factor authentication, an unpatched internet-facing service, or an account belonging to someone who left eight months ago. The controls that would have prevented it were available and unconfigured.

How we approach it

We work through the controls in order of what actually gets exploited rather than what scores well on a framework. Identity first — multi-factor authentication, conditional access, privileged account review, and joiner-mover-leaver process that is enforced rather than documented. Then endpoint posture, email security, patch discipline and backup recoverability.

We report what we find plainly, including where the effort should not go. A finding that costs a month to close and reduces real risk marginally is worth saying so about.

What you get

  • Assessment against exploited attack paths, not just a framework checklist
  • Multi-factor authentication and conditional access implemented, not just recommended
  • Privileged account review and standing access reduction
  • Endpoint protection and patch compliance visibility
  • Backup recoverability tested rather than assumed
  • Prioritised remediation plan with effort and risk stated for each item

How the engagement runs

The sequence, and why each stage comes where it does.

  1. Posture assessment

    Identity, endpoint, email, network and backup controls are reviewed against how compromises actually occur.

  2. Prioritised findings

    Each finding is reported with its real risk, the effort to close it and our recommendation on whether it is worth closing now.

  3. Identity hardening

    Multi-factor authentication, conditional access and privileged access are addressed first, because they close the most common path.

  4. Endpoint and email

    Endpoint protection policy, patch compliance and email filtering are brought to a known state.

  5. Recovery testing

    Backups are restored in a test, because an untested backup is a plan rather than a capability.

  6. Review cycle

    Periodic reassessment, since posture degrades as the estate changes.

Technology we work with

Named so you can check the fit against your existing estate.

  • Microsoft Defender
  • Microsoft Entra ID
  • Microsoft Intune
  • Microsoft Purview
  • Microsoft Sentinel

Frequently asked questions

Do we need a separate security product if we have Microsoft 365 Business Premium?
Often not. Business Premium includes Defender for Endpoint, Intune and conditional access, which covers a great deal - if it is configured. Most organisations holding these licences are using a fraction of what they already pay for, and that is the cheapest security improvement available to them.
Is this a penetration test?
No. This is a configuration and posture assessment, which finds a different and generally more actionable class of problem. Penetration testing is valuable once the basics are in place; before that it usually confirms what an assessment would have told you faster and for less.

Talk to us about cybersecurity services

Tell us where you are now and what you are trying to reach. We will scope it honestly, including whether this is the engagement you actually need.

Start a conversationRequest a quotation