Your clients trust you with everything. Your Microsoft 365 should be as careful as you are.
A fixed-price, expert security uplift of your Microsoft 365, built for small businesses, especially law firms, mortgage brokers and IFAs, who cannot afford a breach, a regulator's question, or a client who quietly loses faith.
"Further to the below, please note our account details have changed. Kindly send the balance to account 40 21 66 / sort code 09 01 28 before Friday. Apologies for the short notice."
Most providers sell you a dashboard and call it security. We start by closing the gaps that actually let people in, misconfigured mailboxes, dormant admin rights, licences bought but never switched on. Only once the foundations are sound does monitoring mean anything at all.
Redirected completion funds and invoice fraud land on the firm, not the bank. The sums are rarely small.
The SRA, FCA and ICO all expect you to protect client data. "We assumed Microsoft handled it" is not an answer.
One compromised mailbox exposes years of privileged correspondence and sensitive personal data.
Referrals dry up quietly. Clients rarely say they left because of a breach, they just stop calling.
A UK company trusted with sensitive client data came to us after a phishing attack reached their clients. In just under two months we rebuilt their Microsoft 365 security from the ground up. What we put in place:
Built a full Conditional Access suite, phishing-resistant MFA for admins, risk-based sign-in blocks and tighter session limits, so a stolen password on its own can no longer open the door to client files.
Brought the powerful admin accounts under PIM with approval workflows and monitored break-glass accounts, so the keys attackers hunt for are locked away, handed out only when needed, and always logged.
Enrolled and hardened every device in Intune with Defender for Endpoint, and forced email authentication (SPF, DKIM, DMARC), so only trusted laptops and phones connect, and nobody can send email pretending to be the firm.
Layered on Defender threat detection watching for anomalies and OAuth abuse, ~96 controls in all, to a Cyber Essentials Plus-aligned baseline, so attacks are caught early and the firm can show, on paper, that it takes security seriously.
A one-off assessment and configuration of your Microsoft 365, handed over for you to run. We set the recommended controls to report-only and show you what to switch on. Nothing is enforced and there's no ongoing support, so you'll need someone technical to hand it over to.
Everything in Self-Service, plus we turn the protections on and keep them right as Microsoft and your firm change. This is where the rules are actually enforced, with ongoing support and reporting as part of the service, the continuity a one-off can't give you.
Everything in Managed, plus round-the-clock monitoring, incident response and certification alignment. Someone is watching your Microsoft 365, and if something happens, we handle it, not you.
● Included ○ Not in this tier · Prices based on a 10-user organisation. The one-off uplift is fixed scope; L2/L3 add a monthly retainer on a 12-month term. Final figures confirmed after the consultation, no obligation.
A security administrator on contract (UK median). One person, no cover, office hours only.
Your protections enforced and kept right by our team, with support and reporting, for less than half a day of a contractor's time a month.
Rate: itjobswatch.co.uk, UK median Security Administrator for the 6 months to July 2026, £515/day (£35,000/yr). &DEV Managed from £200/month on a 12-month term.
If your setup is sound, we'll say so and leave it alone. We're not here to sell you things you don't need.
This is about your Microsoft 365. No servers to buy, no five-year contracts, no vendor lock-in.
You'll always get plain English and a written record a non-technical partner can read and act on.
The one change your people will notice is stronger sign-in. A one-page guide they can follow at their desk, or print and keep, means nobody is caught out on the day.
Not fully. It has excellent security tools, but almost none of the important ones are switched on by default, and Microsoft only secures the platform, not how your accounts, devices and data are set up. We turn on and configure the protections you're very likely already paying for in your licences.
Start with the controls that stop most attacks: multi-factor authentication on every account, locked-down admin accounts, legacy sign-in blocked, email authentication (SPF, DKIM, DMARC), Defender anti-phishing and Safe Links, and only managed devices allowed in. Then check your Microsoft Secure Score and keep it under review. You can work through our free checklist yourself, or we'll do it for you as a fixed-price uplift. Read the Microsoft 365 security checklist →
Cyber assurance means being able to show, with evidence, that your security controls are in place and working. For most small businesses that starts with Cyber Essentials, moves to Cyber Essentials Plus when a customer or contract asks for independent testing, and can extend to IASME Cyber Assurance for wider governance. Customers, insurers and regulators increasingly ask for it. The uplift puts the Microsoft 365 controls in place and gives you a written record of them. Cyber assurance options compared →
It covers the Microsoft 365 side of it: secure configuration, user access control and malware protection for your accounts, email and managed devices. Cyber Essentials also looks at firewalls, routers and software updates on every device, so we'll tell you what else is in scope. Managed Plus includes Cyber Essentials and Cyber Essentials Plus alignment; the certificate itself is issued by an IASME certification body.
General IT support keeps you working day to day; it rarely means someone has deliberately secured your Microsoft 365 against a targeted attack. The two jobs are different, and we're happy to work alongside your existing provider.
The consultation is 30 minutes. The Self-Service setup is typically completed within a week or two, scheduled around your business so there's no disruption to your team.
Almost never. Most changes happen behind the scenes. The main visible change is stronger sign-in, which we roll out with clear guidance so nobody is caught out. See the security key guide →
Yes. The uplift directly supports the data-protection and confidentiality obligations those regulators expect, and the written summary gives you evidence of the steps you've taken.
The one-off uplift is £1,800 for a typical 10-user organisation, with a fixed scope. Managed adds £200 a month and Managed Plus £750 a month, both on a 12-month term. Larger organisations get exact figures after the consultation, with no obligation.
A straightforward call to talk through where firms like yours are most exposed, answer your questions, and explain how the uplift works. No system access, no obligation, just an honest conversation.
Booked, a calendar invite is on its way.
Couldn't book that, pick another time or send an enquiry.
30 minutes · No prep needed · No marketing lists
Protected by reCAPTCHA. The Google Privacy Policy and Terms of Service apply.
Or just email us: [email protected]