Security assessment and hardening

Secure what you have. Find the gaps, then close them.

Your company already runs on Microsoft 365 or Google, a domain and a website, often set up in a hurry years ago. We check how it's really configured, show you what matters most, and fix it with you, without breaking how you work.

01What we check

Five areas, the ones attackers use first.

We review the settings that decide how hard you are to break into, and how quickly you recover if something does go wrong.

SIGN-IN

Accounts and sign-in

  • Multi-factor sign-in for every account
  • Security defaults or Conditional Access policies
  • Who has admin rights, and an emergency access account
  • Old mail sign-ins (POP, IMAP, basic SMTP)
  • Guest accounts and leavers who still have access
MAIL

Email

  • SPF, DKIM, DMARC, MTA-STS and TLS reporting
  • Rules that forward mail to outside addresses
  • Anti-phishing, anti-spam and attachment protection
  • Shared mailboxes and who can send as whom
DEVICES

Laptops and phones

  • Encryption, screen lock and automatic updates
  • Device management and remote wipe
  • Antivirus and threat protection
  • Personal devices with access to company data
DATA

Files and backups

  • External sharing and "anyone with the link"
  • Retention, deletion and audit logging
  • Backups outside your main provider, and a restore test
WEB

Domain and website

  • Who can log in to the registrar, and how
  • DNSSEC, CAA and forgotten subdomains
  • Website encryption and security headers
  • A published security contact (security.txt)
02How it works

From a short call to a hardened setup.

The assessment and the fixes are separate steps: you get the report first and decide what to do with it.

  1. 01Short call

    Free and without obligation. What runs where, how many people, what worries you. We tell you honestly if we're the right fit.

  2. 02Written offer

    Scope, dates and price, agreed in writing before anything starts. The price depends on size and scope.

  3. 03Assessment

    Read-only, together with your admin. Automated checks plus a manual review against recognised baselines.

  4. 04Report, then fixes

    Findings ranked by risk, each with the fix and the effort. If you like, we then fix them with you, change by change.

03Free quick check

Where do you stand today?

Two parts. The outside our domain check reads from public records in seconds. The inside only you can answer: ten questions, about two minutes.

1 · The outside

Mail authentication, DNS, encryption and website settings, checked live. No sign-up.

Free. Shows whether a name is still available, or how secure a domain you already use is and how search engines see its website. No sign-up, no sales call.

2 · The inside
  1. 01Does everyone sign in with a second factor (an authenticator app or security key), not only a password?
  2. 02Are your mail, files and accounting backed up somewhere separate, and have you tried restoring from it?
  3. 03Are company laptops and phones managed: encrypted, with a screen lock, and wipeable if lost?
  4. 04Do admins use a separate account for admin work, and do only a few people (two to four) have admin rights?
  5. 05When someone leaves, are their accounts blocked and their devices returned on their last day?
  6. 06Do operating systems, browsers and apps update automatically on every device?
  7. 07Are old mail sign-ins (POP, IMAP, basic SMTP authentication) switched off, so every mail app has to use modern sign-in?
  8. 08Is the login to your domain registrar protected with a second factor, and can at least two people get into it?
  9. 09Do you share files with outsiders only with named people or links that expire, never "anyone with the link"?
  10. 10Does everyone know how to report a suspicious email, and who to call if an account is taken over?

0 / 10 answered. Your result appears here when all ten are done.

04Tools

Recognised tools, not guesswork.

We run established checks and review the results by hand, so the report reflects your company, not a generic scanner.

Microsoft Secure Score
Microsoft's own measure of a Microsoft 365 tenant, as a starting point.
Maester
Open-source automated tests for Entra ID, Exchange and Teams, including Microsoft's and CISA's recommendations.
CISA ScubaGear
The US cybersecurity agency's baseline check for Microsoft 365, with a detailed report.
CIS Microsoft 365 Benchmark
The checklist our manual review and the report follow.
Our domain check
The outside view: mail authentication, DNS, encryption and website settings.
05Terms

How we work inside your systems.

Looking at a company's setup takes trust. These are the rules every assessment follows; the written offer sets out the details.

Agreed in writing first

Scope, dates, price and the person on your side who authorises the work are agreed in writing before we start. Nothing outside that scope is checked or changed.

Read-only assessment

During the assessment we only look at settings. Changes happen only in the hardening phase, each one agreed with you first, with a way back.

Your admin stays in control

We work in a screen-share session with your administrator, or with a temporary read-only account that you create and remove afterwards. We keep no standing access.

No attacks

This is a configuration review, not a penetration test. We don't try to break in, overload your systems or send fake phishing to your team.

Confidential, with a data processing agreement

Everything we see stays confidential, and we sign an NDA if you want one. Where we could see personal data, we sign a data processing agreement under Art. 28 GDPR.

Settings, not content

We export configuration, not mail or files. Working notes and exports are deleted within 30 days of handing over the report; the report is yours.

A snapshot, not a guarantee

The report describes your setup on the day we checked it. Fixing the findings lowers the risk considerably, but no review can promise that nothing will ever happen.

Price per engagement

The price depends on the number of people, systems and the scope, and is agreed before we start. For businesses only; prices exclude VAT.

Talk to us about your setup.

A short call is free. We tell you what an assessment would cover for your company and what it would cost, before anything starts.

Ask for an assessment