Are we exposed?
Microsoft 365 security assessment
See your real attack surface and what to fix first, in plain English.
In short
What is a Microsoft 365 security assessment?
A Microsoft 365 security assessment, sometimes called a Microsoft 365 security audit, is a fixed-scope review of how your Microsoft 365 environment is configured and where it is exposed. It produces a cyber security rating and a ranked list of fixes, so you know what to do first and what can wait. It is a fixed price of £999 and takes 4 to 6 weeks, with read-only access.
Last updated
What's included
- A cyber security rating for your Microsoft environment
- Findings from threat and malware detection checks
- Identity, email and device exposure explained in business terms
- Fixes ranked by risk and effort
- Useful preparation for Cyber Essentials or a cyber insurance renewal
Most security reviews produce a long list of findings. This one ends with a short list of decisions: what to fix first, what it costs, and what can wait.
Security audit or security assessment?
People search for a Microsoft 365 security audit, an Office 365 security review or a security health check. They usually mean the same thing: an independent look at how the tenant is set up and where it is exposed. We call it an assessment because it ends with a plan, not just a pass or fail.
What we look at
- Identity: multi-factor authentication, Conditional Access, admin roles and accounts that should no longer exist
- Email: phishing and spoofing protection, forwarding rules and mailbox access
- Devices: which devices can reach company data and how they are managed
- Data sharing: files and sites shared outside the business or more widely than intended
- Threat detection: what Microsoft Defender is set to catch and what it is reporting
Each finding is explained in business terms, with the risk it creates and the effort needed to fix it.
Delivered remotely, across the UK and Europe
The assessment is carried out remotely with read-only access to your Microsoft 365 environment, so your location does not matter. Whether your business is in London, Kent, elsewhere in the UK or in Ireland or the rest of Europe, the process, the fixed price of £999 and the timescale of 4 to 6 weeks are the same. Read-only access means nothing in your setup is changed during the assessment.
What every assessment ends with
- Your landscape, mapped across infrastructure, platform and software
- Your current cost, layer by layer
- A roadmap with risks, and savings ranges worth testing
- A senior readout and a report you keep
Read a full sample report for a fictional company
The assessment in 20 seconds
A short, silent overview: the question it answers, what it looks at and what you get. Everything it says is on this page.
Not ready to book? Try the free 12-point security checklist first
How it runs
Step 1
Agree the scope and fixed price
Step 2
Assessment over 4 to 6 weeks, with read-only access
Step 3
Findings, cost and roadmap
Step 4
Decide what, if anything, to do next
Frequently asked questions
Is this the same as a penetration test?
No. It reviews the configuration and exposure of your Microsoft environment and ranks what to fix. It does not attempt to break in.
What does an assessment cost?
Each assessment is a fixed price of £999, agreed before we start. There is no hourly billing.
How long does an assessment take?
4 to 6 weeks. Your team's time is limited to a scoping conversation and giving us read-only access to the relevant environment.
Will you change anything in our systems?
No. Access is read-only during the assessment. We look before we touch, and any changes happen only if you later decide to act on the findings.
Do we keep the report?
Yes. The findings, cost view and roadmap are yours to use, whether you act on them with us, with another supplier or in-house.
Do you sell Microsoft licences?
We are an authorised Microsoft CSP partner. Every assessment is scoped and priced separately from any licence sale.
Related guides
Security
Cyber Essentials for Microsoft 365 businesses
What the UK Cyber Essentials scheme asks of a business that runs on Microsoft 365, and how to prepare so the questionnaire is straightforward.
Cost optimisation
Four places Microsoft 365 licence money leaks
Inactive users, overlapping plans, over-specified seats and duplicate tools. Where to look before your next Microsoft renewal.
Microsoft 365
Microsoft 365 migration checklist for UK firms
A practical checklist for moving email and files to Microsoft 365: planning, domains and identity, security, cutover and what to do afterwards.
Microsoft 365
Microsoft 365 plans compared for UK SMEs
Business Basic, Standard, Premium, E3 and E5 explained in plain English, with a simple way to choose the right plan for each type of user.
Cost optimisation
Microsoft 365 licence renewal: a UK checklist
Twelve things to check in the 90 days before a Microsoft 365 renewal, from term and billing choices to inactive users and overlapping licences.
Security
Ten Microsoft 365 security controls to set first
A practical order of work for securing a Microsoft 365 tenant: multi-factor authentication, Conditional Access, admin accounts, email protection and more.
Other assessments
Is our data ready for Copilot and AI?
Copilot readiness assessment
Find the permissions and governance gaps before AI exposes them.
Should we move, and what will it cost?
Cloud migration assessment
A costed case for Azure, or for staying put, before you commit budget.
What does VMware really cost us, and is Azure the answer?
VMware to Azure assessment
The true cost of staying with VMware, or moving to Azure VMware Solution.
Book the security assessment
£999 fixed price. 4 to 6 weeks.