IT Security & Compliance
One view of your Microsoft 365 security, checked every night.
Explained every month, in plain English, by someone who reads it before you do.
Every report tells you what it couldn't see
Most security reports are written to be reassuring or alarming, depending on what the supplier wants to sell you. Very few tell you what they actually looked at.
Mine opens by listing every data source that was checked, when it was collected, and whether anything failed to collect. Before you read a single finding, you know the scope.
And it closes by telling you what it can't see. If a number in the report shouldn't be relied on for something, the report says so — in writing, every month. Where the sign-in data only covers certain types of activity, it says you shouldn't infer a wider pattern from it. Where a figure shows a setting is available rather than actively enforced, it says that too.
That isn't modesty. It's the difference between a report you can take to your insurer or your board and one you can't.
No alarm for the sake of it
Run an automated scan across a typical business and it hands back a list. A laptop that's been in a drawer since last summer. A backup that stopped because the person left. A new starter who hasn't finished setting up two-step sign-in. An external guest counted as a member of staff.
Those get resolved before the report reaches you. The platform cross-references findings against your device inventory, your licence list and my own support tickets, so a finding with an innocent explanation either carries that explanation or doesn't appear.
You get a shorter list. Not because there's less wrong, but because what's left is real.
I'd rather tell you about the one thing that matters than bury it under nineteen that don't.
What gets checked, every night
Accounts and access — who has two-step sign-in and who doesn't, who holds administrator rights, failed sign-ins, and successful sign-ins from outside the UK. Guests and external users counted separately from your staff, so the numbers mean something.
Microsoft's own security rating for your setup, tracked over time so you can see whether things are improving or quietly drifting — plus the changes that would make the most difference, ranked.
Devices — one combined inventory across Microsoft's tools and my own. Machines running software that no longer gets security updates. Outstanding patches. Disk encryption status. Known vulnerabilities with severity ratings. Devices nobody has used for months, separated out so they don't distort the picture.
Backup — checked against your actual staff list, so anyone not being backed up gets found rather than assumed.
File sharing — who has access to what in SharePoint, including external people with access to company files.
Licences — what you own against what's actually assigned, which usually turns up money being spent on nothing, plus renewal dates before they surprise you.
How much the report can tell you depends on how much it can see
Worth being clear about this, because it varies a great deal between businesses.
The baseline works for anyone running Microsoft 365: accounts, two-step sign-in, administrator rights, mailboxes, file sharing, licences and Microsoft's own security rating. That alone is more than most businesses have ever had.
Beyond that, each additional source opens up another part of the picture:
| If you also have | The report can also cover |
|---|---|
| Device monitoring | Full device inventory, patch status, what's actually in use versus forgotten |
| Microsoft Defender for Endpoint | Known vulnerabilities per machine, severity, and which have a method of attack in circulation |
| Microsoft Intune | Disk encryption status and device compliance |
| Backup through me | Whether every member of staff is genuinely covered — email, OneDrive, SharePoint and Teams |
| Microsoft licences through me | Unused licences you're paying for, and renewal dates before they surprise you |
A client with all of it gets a report running to dozens of pages across fourteen data sources. A client running Microsoft 365 alone gets something considerably shorter — and still useful.
Either way, the report tells you which it is. If a source isn't in use for your business, the coverage section says so rather than quietly leaving a gap.
What you get
A portal you can check any time
A secure, read-only dashboard at portal.mcharg.com — it installs like an app on a phone or desktop. Accounts, devices, backup, sign-ins, file sharing, licences. If you want to know whether someone is backed up, you can look, rather than asking me and waiting.
Things get fixed, not just reported
Findings become jobs in my helpdesk, so they're worked on rather than admired. Remediation is billed from your support hours — you see what needs doing, and you decide what gets done.
A report every month
Your position in plain English, written for a business owner rather than an IT department — technical terms explained where they appear, not assumed.
A one-page summary at the front for anyone who only wants the headline, including the direction your security rating is moving rather than just the number. Then the detail, and a numbered list of what to do next in priority order — marking which items I'll handle myself.
What this isn't
Worth being straight about, because plenty of people sell this sort of thing with language that implies rather more.
- It checks every night. It isn't real-time, and it isn't a 24/7 monitoring centre.
- It doesn't block anything. It reports on the security tools you already have — it isn't a replacement for antivirus or threat protection.
- It's read-only. The platform observes and reports; it never changes your settings by itself. Changes are made by me, deliberately, with you knowing.
- It doesn't certify compliance. It supports good practice aligned to frameworks like Cyber Essentials, which is not the same as a certificate.
- It can't see everything, and the report says which things — every month, in the methodology section at the back.
A note on how the writing gets done
The commentary in each report is drafted with AI and then reviewed and edited by me before it goes out. Every figure comes from your actual data — none of the numbers are generated.
I'd rather tell you that than have you wonder.
What it costs
£120 a month. Remediation work is billed from your support hours. Excludes VAT.
Find out what's quietly wrong.
I'll tell you what's available for your setup before you buy anything, and what it would take to see more.