Find the gaps while they are still cheap

Findings are ranked two ways, because those are the two questions an owner actually asks. First by risk: what is most likely to cause a breach or an outage. Second by effort: what can be fixed this week for free, what needs a project, and what needs a budget line next year. A list of forty findings in alphabetical order is useless. A list that says start with these three, they cost nothing, and they close most of your exposure is something you can act on Monday.

What we inspect

Identity and access: MFA coverage across every account, legacy authentication protocols, administrative account count and separation, dormant accounts belonging to former staff, password policy and conditional access rules. This is where the majority of real-world compromise happens and it is where most audits are thinnest.

Perimeter and network: firewall rule base with justification for every inbound permit, remote access exposure, firmware currency against published advisories, VLAN segmentation, and what your public IP addresses actually present to the internet. We also review wireless security, guest isolation and IoT placement.

Endpoints, data and recovery

Endpoint protection coverage and whether alerts are being reviewed by anyone. Patch state for operating systems and the third-party applications that get exploited in practice. Local administrator rights, disk encryption status, and machines running operating systems that no longer receive security updates.

Then the recovery side, which people forget is a security control. Are backups completing. Are they immutable or could an attacker with domain credentials delete them. When was the last successful restore test, and how long would a full recovery take. An environment with excellent prevention and no tested recovery is one bad morning from a very long week.

There is a free tier and a paid tier and we are open about the difference. The free Deep Dive is a genuine review: inventory, identity posture, patch state, backup verification, Microsoft 365 security settings, external exposure and network mapping. It finds the issues that affect most small businesses, and for a lot of companies it is enough. It takes us a few hours of work and we do it because it is also how we decide whether we can help you.

The paid audit goes deeper: full firewall rule-by-rule review, internal vulnerability scanning with authenticated checks, credential exposure research, segmentation validation, Microsoft 365 configuration against a hardening baseline, and a formal report suitable for an insurer or a client security questionnaire. Related work sits on our vulnerability testing page and cyber security page. More at security.orcait.io.