MFA everywhere, conditional access that reflects how your business actually operates, managed devices, and threat protection that someone is watching. Not a policy document — a configuration you can demonstrate to an auditor or an insurer.
The per-user rate falls as your headcount rises. Set yours below to see the exact figure.
No asterisks. This is the scope of the engagement — anything outside it gets quoted separately rather than quietly absorbed.
Multi-factor on every account including admins and service accounts, rolled out with a comms plan so it doesn't stop anyone working on day one.
Policies built around your risk: block legacy authentication, restrict access by location and device state, step up for sensitive apps.
Company and BYOD devices enrolled, encrypted and compliant — with the ability to wipe company data from a lost phone without touching personal photos.
Endpoint protection, attack surface reduction rules, and phishing defence configured and monitored rather than merely licensed.
The point of the work, stated as what's different afterwards rather than what we did.
The single control that stops the overwhelming majority of account takeovers.
Encrypted, remotely wipeable, and no longer a notifiable data breach.
Because the answer to each one is a screenshot rather than a project.
Set your headcount, pick the options you need, and see what it costs. No account, no card — you'll get a firm proposal from a human.
You move between bands automatically as your headcount changes — there's no renegotiation and no penalty for growing mid-term.
| Band | Headcount | Per user / month |
|---|---|---|
| Starter | 1–10 users | £14 |
| Growth | 11–50 users | £12 |
| Scale | 51–250 users | £10 |
| Enterprise | 251+ users | £8.50 |
A one-time onboarding fee of £1,500 covers the initial build and handover, waived entirely at 200 users and above.
The questions that come up on almost every first call, answered here so you don't have to book one to get them.
Barely. With Conditional Access configured properly, a known user on a compliant device in a usual location isn't prompted every time — the friction lands on the sign-ins that actually look unusual.
Usually yes, and usually cheaper. Defender for Business is included in Microsoft 365 Business Premium, so most clients are already paying for it and running a third-party product alongside. We'll tell you honestly if yours is worth keeping.
Yes — we complete the technical sections for clients on this level as part of the service. Most of the questions map directly to controls we've already configured.
Configure your headcount and requirements — we'll send a firm proposal and a hardening timeline.