Three areas, one approach.

Secure Microsoft workplace

Every device managed, hardened and demonstrably compliant.

A workplace that is managed from the cloud, secure from the first sign-in, and that you can show meets your baseline. Without getting in users’ way.

All about this area

What we do

• Microsoft Intune: compliance, configuration, apps and updates, designed as one whole
• Windows Autopilot, and the right choice between Entra join and hybrid join
• CIS Benchmarks and Microsoft security baselines, tailored and tested for impact
• Hardening: Credential Guard, ASR rules, LSA protection, BitLocker and Windows LAPS
• From GPO to Intune, and from hybrid join to cloud-native management
• Microsoft Defender for Endpoint: onboarding and configuration

What you get

• A documented workplace design
• A baseline with a rationale for every deviation
• Compliance reporting per setting
• Hand-over to your operations team

Technology

• Microsoft Intune
• Windows Autopilot
• Entra join
• CIS Benchmarks
• Security baselines
• Defender for Endpoint

Identity & Zero Trust

The right access, and admin rights only when needed.

Identity is the new perimeter, and Active Directory is often still the foundation. We set up both so they are secure for the organisation and effortless for the user.

All about this area

What we do

• Microsoft Entra ID: design, Conditional Access and phishing-resistant authentication
• Privileged Identity Management: just-in-time admin rights, including for on-premises AD groups
• Active Directory: hardening, the tiering model and cleaning up legacy
• Hybrid identity with Entra Connect and Cloud Sync
• Tenant Restrictions v2 and cross-tenant access for collaboration, mergers and acquisitions
• Cleaning up permissions and clear joiner-mover-leaver processes

What you get

• An identity architecture with documented decisions
• Documented Conditional Access and PIM policies
• An overview of attack paths and how they were closed
• Hand-over to your team

Technology

• Microsoft Entra ID
• Conditional Access
• PIM
• Active Directory
• Entra Cloud Sync
• Microsoft Graph

Application control with EAMP

Only trusted software runs: ransomware and LOLBins don’t get a chance.

Only software you trust gets to run. It is one of the strongest defences against ransomware, and one of the hardest to introduce well. We do it every day, and built our own platform for it.

All about this area

What we do

• App Control for Business: base and supplemental policies, from audit to enforce
• Signed policies, managed installer, and Microsoft’s driver and LOLBin blocklists
• Script enforcement and Constrained Language Mode for PowerShell
• EAMP: compose, simulate, sign and deploy policies alongside Intune
• MSIX packaging and App Attach, including repairing packages that break after conversion

What you get

• A policy architecture that survives updates
• A phased plan from audit to enforce
• Signed policies and a safe way back
• Optional: EAMP for day-to-day management

Technology

• App Control for Business
• EAMP
• MSIX
• App Attach
• Azure Artifact Signing
• Microsoft Intune

Penetration tests & assessments

Knowing instead of hoping that your controls hold.

An attacker sees your environment differently from an administrator. We test like an attacker, with the knowledge of someone who builds these environments every day, and report what really matters.

All about this area

What we do

• Active Directory and Entra ID: attack paths, Kerberos abuse and excessive privileges
• Workplace: local admin rights, LOLBins, App Control bypasses, BitLocker and LAPS
• Configuration review of Intune, Conditional Access and tenant settings against CIS and Microsoft baselines
• Purple teaming: emulating attacks and improving detection in Defender XDR

What you get

• A report with prioritised findings
• Concrete fixes per finding
• A retest after remediation

Technology

• Active Directory
• Microsoft Entra ID
• Microsoft Intune
• Defender XDR
• MITRE ATT&CK