The practice
A good security engagement begins with a better question.
We work on Microsoft cloud security problems where configuration, telemetry and operational evidence do not tell the same story.
Security reviews that lead somewhere.
We review selected Microsoft 365 and Entra ID identity settings, privileged access, Conditional Access and supporting audit evidence. You receive a clear account of the issues observed, what they mean and what should happen next.
Sentinel engineering rooted in data quality.
We investigate diagnostic settings, ingestion paths, relevant Log Analytics tables and analytic-rule prerequisites. Where the expected information is missing, we distinguish possible causes from confirmed findings.
Detect, test, refine.
We write and assess selected KQL detections, evaluate dependencies, and help customers define tests appropriate to their environment. Results are documented with their scope and limitations.
Change carefully.
We implement only customer-authorised changes with an agreed scope, access controls and rollback considerations. Verification is a separate step, not a promise implicit in deployment.
Working standards
We prefer uncertainty stated clearly to confidence invented.
Customer access must be authorised and appropriately scoped. Sensitive log samples should be minimised and handled deliberately. A result is bounded by its data sources, time window and tests.
We do not represent scheduled reviews as a staffed, round-the-clock security operation.