Microsoft 365 · Entra ID · Azure · AWS · AI agents

Cloud and AI security for mid-market organizations

Fixed-fee assessments and hands-on engineers who find what attackers would find first — then help you fix it.

Take the free AI security assessment Explore services

Report-only testing before enforcement
Mapped to CISA, CIS, NIST and vendor baselines
Engineers who stay to implement

Services

All services →

Copilot Readiness Audit

Find what Microsoft 365 Copilot could expose — and fix it before rollout.

3–4 weeks · Typically $10,000–$25,000

Microsoft 365 Security Assessment

An independent, evidence-based view of your Microsoft 365 risk in two to three weeks.

2–3 weeks · Typically $7,500–$15,000

Entra ID Hardening Sprint

Rebuild identity controls on Microsoft's current baseline — tested before anything is enforced.

3–4 weeks · Typically $15,000–$30,000

AWS Security Baseline

Benchmark your AWS estate against AWS's own reference architecture — with guardrails ready to deploy.

2–4 weeks · Typically $10,000–$25,000

Azure Landing Zone Security Review

Measure your Azure subscriptions against Microsoft's Cloud Adoption Framework and Cloud Security Benchmark.

2–4 weeks · Typically $12,000–$25,000

Microsoft Sentinel Quick Start

Stand up Microsoft Sentinel with your highest-value data sources, tuned detections and a cost model.

4–6 weeks · Typically $20,000–$40,000

AI Agent Security Review

Inventory every AI agent, test it the way attackers will, and put identity, egress and kill-switch controls around it.

3–5 weeks · Typically $15,000–$35,000

Cloud Security Assessment

One NIST CSF 2.0 maturity score across Microsoft 365, Azure and AWS — with a costed 12-month roadmap.

4–6 weeks · Typically $20,000–$45,000

Free · 10 minutes · runs in your browser

How exposed is your cloud — and your AI?

Answer 30 questions about identity, Microsoft 365 data, Azure, AWS, AI agents and detection. Get a scored report, your top gaps and a prioritized plan. Optionally, generate an AI-written summary for leadership.

Start the assessment

2026 threat news

All news →

Lessons from a decade of cloud breaches

All retrospectives →

Multi-CloudIncident Teardowns

Shai-Hulud (Sept 2025): A Self-Spreading npm Worm That Steals Cloud Secrets

In September 2025, a self-replicating worm called Shai-Hulud compromised more than 500 npm packages, stealing GitHub tokens and AWS, Azure and Google Cloud keys and publishing them publicly. Here is how it spread and how to protect developer machines and pipelines.

Multi-CloudIncident Teardowns

Salesloft Drift (Aug 2025): Stolen OAuth Tokens Hit Hundreds of Salesforce Tenants

In August 2025, UNC6395 used stolen OAuth tokens from the Salesloft Drift integration to export data from hundreds of Salesforce instances — then searched it for AWS keys, passwords and Snowflake tokens. Here is how SaaS-to-SaaS trust became an attack path.

Microsoft 365Incident Teardowns

ToolShell (July 2025): On-Prem SharePoint Zero-Days Exploited Worldwide

In July 2025, Chinese state actors and a ransomware group exploited ToolShell zero-days in on-premises SharePoint Server, stealing machine keys that let them persist after patching. SharePoint Online wasn't affected. Here is what happened and what to do with the servers you still run.

Microsoft 365Incident Teardowns

EchoLeak (June 2025): The First Zero-Click Attack on Microsoft 365 Copilot

EchoLeak (CVE-2025-32711) was the first widely reported zero-click prompt injection against Microsoft 365 Copilot: a crafted email could cause Copilot to leak data with no user interaction. Microsoft fixed it server-side. Here is what it teaches about AI assistant risk.

Entra ID & IdentityPlatform Changes

Microsoft Entra Agent ID (May 2025): Giving AI Agents Their Own Identities

At Build in May 2025, Microsoft introduced Entra Agent ID, giving AI agents their own identities in the directory. A year later, agents escaping sandboxes made the idea urgent. Here is what Agent ID does and how to govern AI agents like privileged users.

Entra ID & IdentityIncident Teardowns

Marks & Spencer Ransomware (Apr 2025): Scattered Spider Returns to the Help Desk

The April 2025 attack on Marks & Spencer paused online orders for weeks and was expected to cut operating profit by about £300 million. M&S said attackers got in through human error at a third party. Here is the pattern — and how to lock down resets and MFA registration.

How we work

Fixed scope, fixed fee

Every engagement starts with a clear scope and price. No open-ended hourly billing for assessments.

Evidence over opinion

Findings come with the tool output, screenshots or logs behind them, mapped to CISA, CIS, NIST and vendor baselines.

Report-only first

Changes are tested before enforcement. We don't lock your users out to prove a point.

Engineers, not slideware

The people who assess your environment are the people who can fix it.