Services and prices
Every engagement has a fixed scope and a price agreed in writing before work starts. Prices exclude VAT.
Discovery workshop
£1,000
Credited in full if you book a review within 60 days.
A good first step if you’re not sure what you need, or if an insurer, customer or auditor is asking questions you can’t yet answer.
- Two to three hours, run remotely
- Maps your main risks and what is driving them: audits, insurance, customers or the board
- Ends with a recommendation on whether a review is worth it, and which tier fits
Security Posture Review
Choose the tier by your number of Microsoft 365 users. Every tier covers the same six areas and ends with the same report and readout.
Essentials
Up to 75 users
£5,000
The full review, sized for smaller estates.
Standard
75–150 users
£7,500
The full review, with more accounts, devices and policies to assess.
Extended
150–250 users
£10,000–£12,000
The full review plus a deep-dive into logging and detection.
Available from August 2027
What every review covers
Identity and access
Entra ID, multi-factor authentication, Conditional Access and privileged roles.
Microsoft 365 and email
Sharing settings, mail protection and defences against phishing.
Devices
How Defender and Intune are configured across laptops and phones.
Logging and detection
What is recorded, for how long, and whether anyone would notice an attack.
Backup and recovery
What can be restored, how quickly, and whether a restore has been tested.
Governance basics
Policies, admin practices and who owns security decisions.
What you receive
- An executive summary for your board or finance director
- A risk register, with every finding rated and dated
- A 90-day roadmap your IT team can work through
- A 60–90 minute readout to walk through the findings
- A follow-up session 30 days later to check progress
Payment and terms
- 50% when you sign, 50% when the report is delivered, on 14-day terms
- Any change to scope is priced in a written change note before work starts
- Findings are dated and the remaining risk is stated in writing
- A review reduces risk; no review can guarantee you won’t be breached
Two founding-client places from February 2027
At the standard price, with a fixed delivery date and an extra follow-up session after 30 days. In return, I ask for a testimonial and permission to publish an anonymised case study.
After the review
Review clients can ask about follow-on work: incident-response readiness with playbooks and a tabletop exercise, a security governance package, or ongoing support on a monthly retainer.
Not the right fit
- Round-the-clock incident response. I’ll introduce you to a specialist firm.
- Implementation-only projects with no review.
- Budgets under £5,000 for a review.
Not sure which tier fits?
A 30-minute call is enough to tell. No charge and no obligation.