Managed detection
We run Microsoft Sentinel on your data, with detection rules mapped one-to-one to our response playbooks. Alerts are triaged by people, not forwarded to your inbox.
[ Microsoft 365 security · Compliance · AI readiness ] Your business, watched over.
We protect your Microsoft environment, get you compliant with NIS2 and ISO 27001, and make AI tools like Copilot safe to use. A person reviews every alert before it reaches you.
24/7Monitoring by our SOC
15Sentinel detection rules
6Compliance frameworks we work with
0–15 minFirst containment for critical alerts
[ Services ]
More than monitoring.
Security, compliance and safe AI adoption from one team that knows Microsoft 365 inside out. Start with one service or combine them. Everything is built for small and mid-sized organisations.
Protect
Incident response
An on-call responder follows a tested playbook for each threat. We contain first, investigate after, and keep you informed at every step.
Microsoft 365 hardening
We start with a Guardian assessment of your tenant, then fix what it finds: Conditional Access, MFA everywhere, legacy authentication blocked and the audit log on with proper retention.
About Guardian →Comply
Governance, risk and compliance
We measure where you stand against NIS2, ISO 27001, GDPR or DORA, write the policies you are missing, keep your risk register current and prepare you for the audit.
How we handle compliance →Adopt AI safely
AI governance
Your staff already use AI tools, often with company data. We find out which ones, write a clear AI policy, block the risky apps and help you meet the EU AI Act.
Microsoft Copilot readiness
Copilot can see everything a user can see. Before you switch it on, we fix overshared files and sites, add sensitivity labels and data loss prevention, and start with a pilot group.
See the readiness steps →People and insight
Security awareness
Short, frequent training instead of one annual video. Realistic phishing simulations, debriefed the same day, with no-blame reporting so people speak up.
Quarterly security review
Every quarter we run a fresh Guardian assessment and go through what we saw, what we fixed and what still needs attention. Findings come with steps you can act on, such as: we found 3 accounts without MFA, and here is how to fix them.
[ Our tool · M365 Guardian ]
See what your tenant is actually configured to do.
Guardian is the Microsoft 365 assessment tool we built. It reads your configuration and reports it against the benchmarks it should meet, with the evidence for each control and the exact fix where there is one. It reads. It changes nothing unless you approve a specific change, one at a time.
133Controls assessed
9Areas of the tenant
160CIS recommendations
44Entra settings read
What it reads
Identity
Conditional Access, authentication methods, admin roles and PIM, guest and consent settings, risky users, and which AI apps hold consent in your tenant.
Devices
Intune configuration and compliance policies, the Windows 11 security baseline, encryption and Defender settings, against the CIS Intune templates.
Apps and data
Exchange, SharePoint and OneDrive sharing, Teams app policy, sensitivity labels, and SPF, DKIM and DMARC resolved from public DNS.
Copilot
Who can reach Copilot, how far it can see, what extends it and who holds a seat: the four questions a Copilot rollout turns on.
Measured against published benchmarks
CIS Microsoft 365 Foundations
160 recommendationsEvery recommendation, in the benchmark's own numbering, by admin centre and profile level.
Entra ID Security Config Analyzer
44 settingsEach tenant setting compared against its recommended value.
CIS baselines for Intune
Windows · EdgeThe template sets, compared against the policies your tenant actually has.
Microsoft Secure Score
Side by sideRead alongside the rest, so the score and the controls behind it sit on one page.
Your own framework
ISO 27001 · NIST CSFEvery finding also rolls up by compliance clause: ISO 27001, NIST CSF, Essential Eight and more.
What it will not do
[ Guess ]
A control Guardian could not read is reported as unread and left out of the score. A permission you decline never becomes a pass.
[ Write without asking ]
Every change is previewed as the exact request, approved one at a time and logged. Write access is a separate consent, asked for only when you turn it on.
[ Pretend it covers everything ]
Some settings have no Microsoft Graph API. Those are listed with the exact PowerShell command or portal path to check them by hand.
Licence
Any Microsoft 365 licence, from Business Basic to E5. Nothing is scored against a licence you do not have.
Approval
A Global Administrator approves the read permissions once. After that, a reader role is enough.
Access
Global Reader or Security Reader runs the assessment. Guardian never needs Global Administrator to read.
Footprint
No agent, no connector, no data leaving your tenant. One enterprise application, removed in a single step.
Ask for a Guardian assessment →
One approval and about two minutes. It can also run inside your own Azure environment.
[ What we watch for ]
Key use cases
Each threat has its own detection rules in Microsoft Sentinel and a response playbook we have rehearsed. Select one to see what we look for and what we do first.
[ UC-01 · Ransomware ]
First response window 0–15 min0001 Mass file encryption0002 Shadow copy deletion0003 Discovery commands
What we watch for
- Mass file encryption or a tripped canary file
- Shadow copies being deleted
- Outbound command-and-control beaconing
What we do first
- Isolate affected hosts through EDR containment
- Keep machines powered on so memory evidence survives
- Page the incident responder on call
[ Governance, risk & compliance ]
Compliance you can show an auditor.
We translate the framework into work your team can actually do, and keep the evidence in order. Most clients start with a gap analysis against the one framework that applies to them.
NIS2
EU rules for essential and important entities: duty of care, management accountability and incident reporting.
ISO 27001
The international standard for an information security management system, from scope to certification audit.
GDPR (AVG)
Protecting personal data, records of processing and breach notification to the Autoriteit Persoonsgegevens.
DORA
Digital operational resilience for financial entities and the ICT suppliers that serve them.
EU AI Act
Rules for AI systems by risk level, including the duty to make sure staff understand the AI they use.
CIS Controls
A prioritised set of technical safeguards. A practical baseline when no formal framework applies yet.
What you get
- A gap analysis against the framework that applies to you, backed by Guardian evidence
- Information security policies written for your organisation
- A risk register and treatment plan that stays current
- Supplier and third-party risk assessments
- An incident reporting process that meets NIS2 and GDPR deadlines
- Audit preparation and evidence collection
[ AI & Copilot readiness ]
Make AI safe to use before you switch it on.
Microsoft Copilot can see everything a user can see. If files are overshared today, Copilot will find them tomorrow. We fix that first, then help you roll it out.
- 01
Scan
We run Guardian on your tenant to map who can reach Copilot and what it can see: overshared SharePoint sites, Teams with guests and files shared with anyone who has the link.
- 02
Clean up
We fix permissions and archive stale sites, so Copilot cannot surface what people should never have seen.
- 03
Label and protect
Sensitivity labels and data loss prevention in Microsoft Purview keep confidential data out of prompts and answers.
- 04
Pilot
Copilot goes to a small group first, with clear guidance and monitoring of what it touches.
- 05
Roll out
A wider rollout with an AI policy, short training and usage reporting you can show to management.
| Files shared with anyone who has the link | 1,284 | Critical |
| Documents with a sensitivity label | 12% | Critical |
| SharePoint sites open to everyone | 37 | Warning |
| Guest accounts inactive for 90+ days | 54 | Warning |
| Unified audit log enabled | On | OK |
| MFA enforced for all users | 100% | OK |
AI issues beyond Copilot
- Find out which AI tools your staff already use, and with what data
- A clear AI policy: which tools are allowed, and for what
- Block or allow AI apps with Defender for Cloud Apps
- Stop sensitive data from being pasted into public chatbots
- Review AI features in the software you already buy
- AI literacy training that meets the EU AI Act
[ How detection works ]
From first signal to closed incident.
Four steps, the same every time. You always know what we are looking at and what happens next.
01
Connect
We enable the data connectors for Defender XDR, Entra ID and Office 365 in your Sentinel workspace.
02
Detect
Fifteen analytics rules watch for ransomware, account takeover, phishing, data exfiltration and more.
03
Respond
The matching playbook starts. Sessions are revoked, hosts isolated, payments held, as the threat requires.
04
Report
You get a plain-language summary: what happened, what we did, and what to change so it does not happen again.
| 09:14:02 | 0006 | 14 MFA push requests in 6 minutes for one finance user | Critical |
| 09:14:40 | PB-02 | All active sessions revoked for the user | Done |
| 09:16:11 | 0004 | Inbox rule forwarding mail to an external address removed | Done |
| 09:21:30 | PB-02 | Finance alerted, outgoing payments from this user on hold | Hold |
| 09:32:05 | PB-02 | Password reset and MFA re-enrolled from a trusted device | Contained · 18 min |
[ Insights ]
Technical notes from our SOC.
How we build detection, response and compliance on Microsoft 365, written for the people who have to run it.
MDR for Microsoft Sentinel: architecture, detection engineering and containment
Why a deployed SIEM is not yet a security operation, and the collection, detection and response architecture that closes the gap.
Read the article →Frequently asked questions
Do we need our own security team to work with Cyfenced?
No. Our services are built for small and mid-sized organisations without their own security operations centre. We monitor, triage and respond; your IT team stays informed and approves the actions that affect your business.
How fast does Cyfenced respond to a security incident?
Every threat has its own playbook with a first-response window. For critical alerts such as ransomware and phishing, first containment starts within 0 to 15 minutes; for business email compromise within 30 minutes.
Does Guardian change anything in our Microsoft 365 tenant?
No. Guardian reads your configuration and changes nothing unless you approve a specific change, one at a time. It installs no agent, and the single enterprise application it uses can be removed in one step.
Which compliance frameworks does Cyfenced work with?
NIS2, ISO 27001, GDPR (AVG), DORA, the EU AI Act and the CIS Controls. Most clients start with a gap analysis against the one framework that applies to them.
Is it safe to switch on Microsoft Copilot?
Copilot can see everything a user can see, so overshared files become visible through Copilot. We scan for oversharing, clean up permissions, add sensitivity labels and data loss prevention, and roll out to a pilot group first.
[ Get in touch ]
Tell us what needs protecting.
A short conversation is enough to tell you where you stand. No sales scripts, no scare stories.
- hello@cyfenced.com
- Reply
- Within one working day
- First call
- 30 minutes, no obligation
- Works with
- Microsoft 365 · Azure · Defender · Purview