Skip to content
Assessment service

One picture of the estate, with the record behind every number.

Read-only assessors for Active Directory, Entra ID and Microsoft 365, Azure, AWS, Google Cloud and the AI platforms in use, with the identity plane as the key that joins them. Every finding carries the population it was measured over, what was read and what could not be, and its movement since the last snapshot.

View sample report Request the full report Talk to us
Cross-Estate Security Assessment mark
What you receive

Three artifacts, one calculus.

Every plane is placed on the same scale: impact (how serious the finding is), exposure (what was observed), and extent (how much of the population it touches). The same number appears in all three artifacts, and each one traces to a tool record.

Security Determination Map

Actions and decisions for the board, every plane on one scale. What to do first, what is already in hand, and what was declared rather than observed, each marked as such.

Security Summary

The measures with their movement since the last snapshot: improved, worsened, new, resolved, and not comparable with the reason stated. A number never moves because a tool changed.

Findings workbooks

Per plane, every finding with its population, what was read and what could not be, and the evidence row it came from. The engineer works from the same rows the board is shown.

How it works

Security priorities across your estate, backed by evidence.

Five kinds of estate, read by their own assessors, feed one assessment. What comes out is a decision you can defend: what to do first, who owns it, and whether last quarter's work moved the number.

What is read
Identity and directoryEntra ID and Active Directory
Microsoft 365 and collaborationExchange, SharePoint, Teams, Purview, Copilot
Cloud platformsAzure, AWS, Google Cloud
Endpoints and security toolingIntune, Defender, Sentinel
AI platformsCopilot, enterprise AI assistants, OAuth apps and agents

Cross-Estate Security Assessment

Read-only, run as an ordinary account. Every finding carries the population it was measured over, what was read and what could not be, and its movement since the last snapshot.

  • one scale for every plane: impact, exposure, extent
  • identities correlated across planes on verified identifiers
  • measures two assessors share are compared; a difference is explained, never averaged
What you decide with
Prioritised actionsWhat to do first, on one scale for every plane: impact, exposure and extent, each stated.
Accountable decisionsEvery number traces to a record of what was read; what could not be read is reported, never counted as clean.
Change over timeThe second assessment shows movement, not a new list: improved, worsened, new, resolved, or not comparable with the reason.
The architecture behind it

Entra ID at the center. Each estate read by its own assessor.

Solid lines are the identity joins the assessors match on. Dashed amber lines are telemetry into the security tooling. Every assessor's derived files converge in the Decision Map.

identity join: the key the assessors match on telemetry into the security tooling ASSESSOR the assessor that reads the plane alerts, incidents and assessments keyed to identities and devices same identities: mailboxes, role groups, consents, Copilot seats Connect Sync: SID and immutable id unmatched and ambiguous identities stay visible seats, SSO, consents; discovery keyed to users IAM members by email on the org's domains federated roles trust the tenant IdP; native IAM users sit outside it device records, join state, OS build matched to MDE and Intune records RBAC principals: users, groups, service principals Entra ID the tenant's identity plane users, groups, devices apps, roles, policies ENTRA & M365 ASSESSOR AD ASSESSOR Security tooling Defender XDR, Sentinel, Defender for Cloud, Defender for Identity, Defender for Cloud Apps ENTRA & M365 ASSESSOR Microsoft 365 Exchange, SharePoint, Teams, Purview, Copilot seats and content reach ENTRA & M365 ASSESSOR Active Directory forest, domain controllers, privileged groups, AD CS, delegation, trusts AD ASSESSOR AI estates Copilot, enterprise AI assistants, OAuth apps and agents, AI apps found by Defender for Cloud Apps AI PLATFORM · ENTRA & M365 ASSESSOR Google Cloud org policy, IAM, service accounts, keys, buckets, firewall rules, KMS, Gemini, Vertex AI: APIs, keys, roles GOOGLE CLOUD & GEMINI ASSESSOR AWS accounts and regions, IAM, S3, EC2, GuardDuty, Config, Access Analyzer Sentinel: CloudTrail, flow logs, GuardDuty Defender for Cloud: CSPM, attack paths AWS ASSESSOR Endpoints Entra device records, Intune, Defender for Endpoint inventory ENTRA & M365 ASSESSOR Azure subscriptions, RBAC, resources, diagnostics, Key Vault, backup ENTRA & M365 ASSESSOR derived files from every assessor: findings, populations, not assessed, comparisons Decision Map One calculus for every plane: impact (catalog severity) × exposure (what was observed) × extent (count over population). Determination Map, Security Summary (measures with movement), findings workbooks; every number traces to an assessor record. Shared measures compared, differences explained, never averaged; cross-plane joins: Conditional Access exclusions against privileged holders. One evidence model across every estate, with the record behind every number. Movement since the last snapshot on every finding, so progress is demonstrated, not asserted.
  1. Entra IDEntra & M365 Assessor · AD Assessor

    The tenant's identity plane: users, groups, devices, apps, roles, policies. The key every other plane joins on.

  2. Active DirectoryAD Assessor

    Forest, domain controllers, privileged groups, AD CS, delegation, trusts.

    Joins Entra through Connect Sync on SID and immutable id; unmatched and ambiguous identities stay visible. Defender for Identity sensors on the domain controllers feed the security tooling.

  3. Microsoft 365Entra & M365 Assessor

    Exchange, SharePoint, Teams, Purview, Copilot seats and content reach.

    Same identities: mailboxes, role groups, consents, Copilot seats.

  4. AzureEntra & M365 Assessor

    Subscriptions, RBAC, resources, diagnostics, Key Vault, backup.

    RBAC principals are the tenant's users, groups and service principals. Defender for Cloud assessments and alerts feed the security tooling.

  5. EndpointsEntra & M365 Assessor

    Entra device records, Intune, Defender for Endpoint inventory.

    Device records (join state, tags, OS build) matched to MDE and Intune records. Defender for Endpoint sensor telemetry feeds the security tooling.

  6. Security toolingEntra & M365 Assessor

    Defender XDR, Sentinel, Defender for Cloud, Defender for Identity, Defender for Cloud Apps.

    Alerts, incidents and assessments keyed to identities and devices.

  7. AWSAWS Assessor

    Accounts and regions, IAM, S3, EC2, GuardDuty, Config, Access Analyzer.

    Federated roles trust the tenant IdP; native IAM users sit outside it. CloudTrail, flow logs and GuardDuty to Sentinel; CSPM and attack paths to Defender for Cloud.

  8. AI estatesAI Platform · Entra & M365 Assessor

    Copilot, enterprise AI assistants, OAuth apps and agents, AI apps found by Defender for Cloud Apps.

    Seats, SSO and consents; discovery keyed to users.

  9. Google CloudGoogle Cloud & Gemini Assessor

    Organization policy, IAM, service accounts and keys, buckets, firewall rules, Cloud SQL, KMS, detection configuration; Gemini and Vertex AI APIs, API keys and AI platform roles.

    IAM members matched by email on the organization's domains; external bindings reported. Federation pools not yet read.

  10. Decision Mapevery assessor

    One calculus for every plane: impact (catalog severity) × exposure (what was observed) × extent (count over population). Determination Map, Security Summary and findings workbooks; every number traces to an assessor record.

    Measures two assessors share are compared and a difference is explained, never averaged. Cross-plane joins: Conditional Access exclusions against privileged holders; dormancy on both planes.

How it runs

Read-only, recorded, repeatable.

  • Read-only, run as an ordinary account. No elevation, no agent, no write to your platform.
  • Every read is recorded with its result: successful, absent, denied, failed or truncated. The record is the receipt that the activity was ours.
  • A read that could not complete is reported as unknown, never counted as clean. A thin result is information, not reassurance.
  • Snapshots are compared, so the second assessment shows movement rather than a new list.
  • Review material for anyone outside the engagement carries no account name and no address; the packager refuses to produce one that would.
What it covers

Six estates, one evidence model.

Active Directory

Forest and domain controllers, privileged groups, delegation, AD CS templates, the sync bridge to Entra.

Entra ID & Microsoft 365

Roles and PIM, Conditional Access, apps and consents, Exchange, SharePoint, Teams and Purview, Copilot seats and content reach.

Azure

Subscriptions, RBAC, resources, diagnostics, Key Vault, backup, Defender for Cloud assessments and attack paths.

AWS

Accounts and regions, IAM, S3, EC2, GuardDuty, Config and Access Analyzer.

AI platforms

Copilot, enterprise AI assistants, OAuth apps and agents, and the AI apps Defender for Cloud Apps discovers.

Google Cloud & Gemini

Organization policy, IAM, service accounts and keys, buckets, firewall rules, Cloud SQL, KMS and detection configuration; the Gemini and Vertex AI surface: APIs, API keys and AI platform roles.

See it on a real estate before yours.

Open the interactive sample now: a demonstration estate, with figures and dates randomized. Or request the full report, a complete assessment of our own lab forest and tenants: the same artifacts, the same calculus, no client in it.

View sample report Request the full report All capabilities