Secure Score baseline
We read your current score in the Microsoft Defender portal, break it down by Identity, Devices, Apps, and Data, and benchmark it against organisations of similar size.
Secure Score UpliftPosture Audit
Secure Score
Microsoft Secure Score already measures your tenant against dozens of controls across identity, devices, apps, and data. Most SMBs have never read it. We baseline it, benchmark it against businesses your size, and hand you a roadmap that works the few actions that move the needle - MFA, legacy auth, admin roles - before the long tail.
Next step
Ready to scope Secure Score for your business?
What’s included
Scope that’s actually defined.
Every inclusion below is documented, delivered, and renewable under our standard agreement. No surprise scope. No silent exclusions.
High-impact action roadmap
A prioritised list led by the actions worth the most points for the least effort - MFA for all users, MFA for admins, blocking legacy authentication - then the long tail, ranked by impact.
Identity hardening review
Entra ID configuration reviewed against the controls Secure Score measures: admin role sprawl, MFA coverage, conditional access, banned passwords, and security defaults.
Device and app coverage
Where unmanaged devices and unconfigured Defender or Intune policies are dragging your score down, and what enrolling them buys you.
Re-measure and report
After remediation we re-baseline (changes take 24 to 48 hours to post) and give you a before-and-after you can show a board or an insurer.
What’s not included
The boundaries, stated up front.
Knowing where a service stops matters as much as knowing what it covers. Here’s what sits outside this engagement - so there are no awkward surprises later.
A guaranteed target number
Microsoft publishes no 'right' Secure Score, and we won't invent one. We work the high-impact actions relevant to your business; the number follows. Chasing 100% means actioning controls you may not need.
Licences the actions require
Some improvement actions need a specific Microsoft 365 or Defender licence. We flag which, and the cost, but the licence itself is billed at cost, not bundled.
The full Essential Eight or CIS assessment
Secure Score measures your Microsoft tenant. A framework gap analysis against Essential Eight or CIS is broader, and is a separate, deeper engagement - see those pages.
How we deliver
A sequence you can hold us to.
Every engagement runs the same four steps. You always know which one we’re in and what comes next.
- 01
Baseline
We connect to your Microsoft 365 tenant and read the current Secure Score across all four categories, with the comparison benchmark for businesses your size.
- 02
Prioritise
We rank every improvement action by points, effort, and user impact - and tell you honestly which ones are noise for a business like yours.
- 03
Remediate
We action the high-impact items with your sign-off, or hand the list to your team, tracking each through the Defender portal's status workflow.
- 04
Re-measure
We re-baseline after the changes post, and report the uplift with a documented before-and-after.
Frequently asked
The questions we get most.
Is Secure Score the same as being secure?
No, and Microsoft says so plainly. It measures how many recommended controls you've adopted, not your odds of a breach. It's an excellent, honest baseline and a shared scoreboard - but a high score with one unpatched internet-facing server is still exposed. We read it as one input, not the whole story.
How long does it take?
A baseline and roadmap is typically a few days. Remediation depends on how much low-hanging fruit there is - enabling MFA and blocking legacy auth can lift the score quickly; the long tail is a longer programme.
Do you need access to our tenant?
Yes - read access to your Microsoft 365 and Defender environment to baseline, and delegated admin if you want us to action the remediation. We scope exactly what access we need, in writing, first.
What if our score is embarrassing?
It usually is to start - that's the point. A low score is a roadmap, not a verdict. The businesses that get breached are the ones that never looked.
Related reading
All articlesGo deeper on secure score
Strategy · 9 min read
Microsoft Copilot Cowork is GA: what it costs, and how to stay in control
Copilot Cowork is now generally available, and it is billed in a way that catches people out: a fixed seat plus a metered usage charge that can dwarf it. Here is how the pricing works, what it can cost, and every lever to cap the spend.
Read articleCompliance · 9 min readAsked for CIS Controls and the Essential Eight? Here's how they actually map.
Auditors and insurers increasingly want both CIS Controls v8 and the Essential Eight. They overlap, but they aren't the same shape. Here's the control-by-control mapping we use - and the four CIS controls the Essential Eight quietly leaves you exposed on.
Read articleHow-to · 11 min readCopilot rollout playbook: from license to measured productivity
Microsoft 365 Copilot is the most expensive per-user add-on a business will add this year. Most rollouts fail on the prep, not the technology. Here's the sequence we use to make sure it actually pays for itself.
Read articleRelated services
All servicesUsually bundled with secure score
Security Assessments
Vulnerability scans, Microsoft 365 audits, security posture reviews, and dark web exposure checks. Know where you stand before an attacker does - with a remediation plan you can actually act on.
Learn moreEssential 8 Gap Analysis
Your maturity against all eight ACSC mitigation strategies, scored to your target level, with a roadmap to close the gaps. The Australian baseline that primes, contracts, and cyber insurers increasingly ask you to prove.
Learn moreCompliance
Roadmap, remediation, and ongoing attestation against the CIS Critical Security Controls and the Australian Essential Eight. Frameworks that actually get implemented, not just referenced.
Learn moreReady when you are
Leave the MSP that doesn’t pick up.
Tell us what your current setup looks like. We’ll send back a quote, a transition plan, and a firm date you’d be onboarded - within 48 hours.
- Response
- Within 48 hours
- Format
- Written quote
- Discovery call
- Not required
- Contracts
- No lock-in terms