Security assessment
For most organizations the Microsoft 365 tenant is now the crown jewel and the initial access vector at the same time. We assess it the way an attacker would enumerate it.
Bought under NAICS 541512 and 541519.
What this answers
This is our general security assessment, and it is scoped where the risk actually sits: the Microsoft 365 and Entra ID tenant your organization signs in through. Email, files, identity and device management in one place, reachable from anywhere with a valid token. That is a reasonable architecture and an enormous amount of consequence in one place.
This assessment combines configuration review with attack-path analysis. We are not producing a secure-score screenshot; we are identifying the specific paths from an ordinary user account to tenant-wide control.
What is in scope
- Conditional access policy, including gaps between logged and enforced
- Legacy authentication paths that bypass modern controls
- Privileged role assignment and standing Global Administrator rights
- Application registrations, consent grants, and third-party tenant access
- Exchange Online mail flow, forwarding rules, and transport rules
- SharePoint and OneDrive external sharing posture
- Audit logging coverage and retention against your obligations
- Device compliance and whether it is actually required
How it runs
A short, fixed-scope engagement. We tell you the duration before you commit.
Read-only collection
We collect configuration through a scoped read-only service principal. Nothing is changed.
Configuration review
Assessed against Microsoft security baselines and against what we see exploited in practice.
Attack-path analysis
Privilege chains from an ordinary account to tenant-wide control, mapped with the techniques our red team uses.
Consent and application review
Every third-party application with access to your tenant, what it can reach, and who approved it.
Readout and roadmap
Prioritized findings with the configuration change for each one, written so your administrators can act without us.
What you receive
- Configuration findings with the specific setting for each
- Privilege-escalation path analysis
- Third-party application and consent inventory
- Conditional access gap analysis
- Audit logging assessment against your compliance obligations
- Prioritized remediation plan your administrators can execute
A natural follow-on
Most organizations that run this assessment move next to identity and Zero Trust work, because the findings cluster there. If you are already planning that program, the two can be combined into one engagement.
Scope it before you budget it
Tell us the environment and the obligation. We come back with the approach, the duration, and what drives the price.