Security that is configured, not just licensed.
Most mid-market firms pay for Microsoft 365 Business Premium or E5 and use a tenth of the security capability it includes. We close that gap. Defender, Purview, Intune, Sentinel, and the policies and processes that make them work in your environment.
What Security and Compliance includes.
The full Microsoft security stack, configured to your environment, with documentation and ongoing assurance.
Built by someone who has done this for systems that cannot fail.
Adam Grimes leads our security practice. He spent seven years at Lockheed Martin and Leidos including a leading role on a £500m air traffic control modernisation programme for UK NATS. Working on systems where failure has real consequences shaped how he approaches Microsoft security: rigorous, documented, tested, and unsentimental about which workarounds are acceptable and which are not. He brings that standard to every Cloudbliss security engagement, whether the client is a fifty-person firm or a regulated mid-market business.
How the work usually scopes.
Accelerator route.
Security Audit (£1,200 to £3,500), Secure-by-Design Pack (£1,950 to £4,800), Copilot Readiness Assessment (£1,400 to £2,400).
Custom project route.
Regulated environment hardening, multi-site rollout, ISO 27001 readiness programmes, incident response architecture. £18,000 to £80,000.
For regulated industries.
Some sectors carry compliance requirements that change how the work is shaped. We have built specifically for these.
Security and Compliance questions.
Almost certainly not at the start. Most firms with Business Premium are using a fraction of the security capability it already includes. The first engagement is usually configuring what you already have, not buying more. After that, larger firms may genuinely need E5 features or Sentinel; we assess and tell you honestly.
Three to six months from a typical mid-market starting point. The gap analysis is one to two weeks, the remediation work is one to three months depending on the gap, and the certification itself is two to four weeks. We can run the whole programme or just the parts where you do not have internal capacity.
We do not do penetration testing in-house. We partner with two specialist UK pen testing firms and manage the engagement on your behalf, integrating the findings into the remediation plan. Trying to do pen testing inside a Microsoft consultancy creates a conflict of interest; we keep it separate.
For clients on managed support, we have a defined runbook and we are involved from the first sign. For one-off security engagements we hand over a documented IR plan and tabletop exercise outputs; if an incident happens later, you call us and we respond against the existing plan.
Only if your data permissions are already broken. Copilot surfaces what the user is permitted to see. In most tenants we audit, that is more than it should be. The Copilot Readiness Assessment finds those permission problems and gives you a remediation plan before you switch Copilot on.