Fixed-scope work with a written deliverable.
Every engagement is quoted before it begins. If a job turns out larger than scoped, it stops and requotes rather than running up hours.
Microsoft 365 & Entra ID Assessment
Tenant reviewed against the CIS Microsoft 365 Benchmark — conditional access, MFA coverage, legacy authentication, privileged role assignment, guest sharing, audit logging.
~12 HOURS
Active Directory Security Review
Privileged group membership, stale and orphaned accounts, service account posture, delegation and ACL review, domain controller configuration, Kerberos hygiene.
~10 HOURS
Email Authentication & Security
SPF, DKIM and DMARC implemented and ramped to enforcement. Exchange Online Protection or Proofpoint policy tuning, anti-impersonation, quarantine workflow.
~8 HOURS
Endpoint Detection & Response
Deployment, policy configuration, prevention and detection tuning, exclusion management, alert workflow. CrowdStrike Falcon or Microsoft Defender for Endpoint.
SCOPED
Fractional Security Analyst
A standing monthly block for advisory, configuration review, alert triage, tooling evaluation, policy support, and a monthly posture summary to leadership.
MONTHLY
How this is different from a reseller.
Defensive only
Blue team work — assessment, hardening, detection, response. No penetration testing, no forensics for litigation, no audit attestation. Those get referred to people licensed for them.
No license resale
You hold your own vendor licenses and keep full control of your tenant. Nothing here depends on a margin from what you buy, so the recommendation is just the recommendation.
Written authorization first
Nothing touches a production system, scans a network, or simulates an attack against your users without signed scope in the file. Standard practice, and it protects both sides.
Start with a conversation, not a quote.
A short call to understand the environment and what is actually worrying you. No obligation, and no cost.