Microsoft specialist since 2005
A Microsoft workplace that is secure, and can prove it.
For organisations with a complex Microsoft estate and little room for error. We set up your workplace, identities and application control along Zero Trust lines, build it ourselves, and test whether it holds.
You’ll hear from us within two business days.
- 2005Microsoft specialist since, for clients large and small
- 20+ yearsof enterprise IT in the Netherlands and the United States
- 3-in-1advice, build and validation by the same specialist
- EAMPour own platform for App Control, configuration and packaging
Who it’s for
For organisations where a workplace mistake really hurts.
Regulated
Financial services, insurance, the public sector and essential services: requirements from DORA, NIS2 or the Dutch BIO that you have to be able to demonstrate.
Complex Microsoft estate
Many devices, hybrid identity, old GPOs and applications nobody dares to touch any more.
Under pressure
A merger or acquisition, the move to cloud-native management, or the wish to only allow trusted software.
What makes us different
Advice, build and validation in one hand.
No advisory report that ends up in a drawer, and no implementation without a rationale. The same specialist designs the architecture, builds it, and tests whether it holds.
Advise
Architecture and decisions, matched to your risks and regulations, and written down so your organisation can follow them.
Build
Set up and automate: Intune, Entra ID and App Control, with infrastructure as code where possible.
Validate
Test like an attacker, demonstrate that the controls work, and hand it over to your team.
What we do
Three areas where we make the difference.
We focus on what removes the most risk in Microsoft environments. With penetration tests to prove it works.
Secure Microsoft workplace
Every device managed, hardened and demonstrably compliant.
Intune, Autopilot and Entra join, with CIS and Microsoft security baselines that fit your organisation.
Learn moreIdentity & Zero Trust
The right access, and admin rights only when needed.
Microsoft Entra ID, Active Directory, Conditional Access and Privileged Identity Management, tested against attack paths.
Learn moreApplication control with EAMP
Only trusted software runs: ransomware and LOLBins don’t get a chance.
App Control for Business (WDAC) from audit to enforce, with our own platform EAMP, and MSIX packaging that works.
Learn moreAnd to prove it: penetration tests of Active Directory, Entra ID and the workplace. About the pentest
Cases
How we approached it before.
A Zero Trust workplace for a US financial services company
From workplace architecture to application allow-listing and security architecture.
Read the case Insurance · NLMigrations for mergers and acquisitions at a Dutch insurer
Bringing environments together and taking them apart, without the business grinding to a halt.
Read the case Public transport · NLIdentity and access management at a public transport operator
Design questions around Entra ID and privileged access, and the workplace roll-out.
Read the caseOur own platform
EAMP: App Control for Business, finally manageable.
Application allow-listing is one of the strongest defences against ransomware, but in practice it is a pile of cmdlets, XML and manual work. EAMP turns it into a manageable process, alongside Intune.
App trust
Compose, simulate, sign and deploy App Control policies. From audit to enforce, seeing in advance what will be blocked.
Cloud configuration
The successor to GPO: ADMX and GPO import, four-eyes approval and signed policies with drift and tamper detection.
Packaging
From installer to signed MSIX package, with automatic fixes, and back into Intune as an app.
Under the hood
The whole Microsoft ecosystem, down to the protocol level.
For those who want to know: the difference is below the console. Kerberos and Primary Refresh Tokens, MDM protocols, code integrity and policy signing. Understanding that is what solves the problems that otherwise stay unsolved.
-
Identity
- Microsoft Entra ID
- Active Directory
- Entra Connect & Cloud Sync
- Conditional Access
- PIM
- Windows Hello for Business
-
Devices
- Microsoft Intune
- Windows Autopilot
- Entra join
- Hybrid join
- Co-management
- Windows LAPS
- BitLocker
-
Applications
- App Control for Business
- EAMP
- MSIX & App Attach
- Win32 apps in Intune
-
Hardening
- CIS Benchmarks
- Microsoft security baselines
- ASR rules
- Credential Guard
- GPO to Intune
-
Detection
- Defender for Endpoint
- Defender XDR
- Microsoft Sentinel
-
Validation
- Penetration tests
- Purple teaming
- Compliance reporting
Start with a 20-minute intake.
We discuss your situation and tell you honestly whether and how we can help, even if the answer is ‘you don’t need this’. You’ll hear from us within two business days.