Your firm pays Microsoft every month for security capabilities that came with your licence. Your IT provider configured those capabilities and told you they are working. Your Secure Score looks healthy. None of that tells you whether your security controls are actually working. Secure Score measures the presence of features, not whether those features are correctly configured or actively enforcing.
Metis Security provides a Microsoft 365 Security Assessment designed to give you a clear, evidence-led view of how your tenant is performing in practice, and what matters most to address first. This assessment provides independent validation of Microsoft 365 security controls: confirming what is already effective, and identifying priority gaps where enforcement or coverage may fall short.
We go beyond surface-level checks. We evaluate identity and access enforcement, threat protection configuration, data protection controls and governance settings, combining technical analysis with risk-based prioritisation where required. The outcome is a focused, actionable view of your Microsoft 365 security posture and control effectiveness.
We focus on clarity over noise. You won’t receive a checklist or a generic scorecard — you’ll receive findings that explain what is wrong, why it matters, and what to do next.
Metis Security provides that independent perspective: no managed services, no licence sales, nothing that could colour the findings. An assessment your IT provider can point to with confidence and your leadership can rely on without reservation.
Every engagement is personally delivered by David Morgan – CISSP certified since 2002, with current Microsoft Security certifications and 27 years of hands-on cybersecurity testing experience. The person you brief is the person who does the work and signs the report. No junior staff, no handoffs, no dilution.
This assessment is for professional services firms – law practices, accountancy firms, financial services consultancies, and similar organisations – that are paying for Microsoft 365 security capabilities and have never independently verified whether those capabilities are working as intended.
It is most valuable when:
M365 Security Assessment engagements are structured to deliver clear outcomes, not open-ended consultancy.
Microsoft 365 environments vary significantly in scale, architectural complexity and operational maturity. Meaningful security assessment requires scope aligned to identity structure, collaboration exposure, governance model and monitoring configuration. Engagements are structured to provide depth of analysis and defensible conclusions, not surface-level configuration review.
The assessment is fixed price. For most professional services firms with 200 or more licensed users, the fee is less than half of their monthly Microsoft 365 licensing spend. Pricing is confirmed in the scoping conversation based on your specific environment.
A representative mid-sized tenant may include:
Larger or multi-tenant environments are scoped accordingly.
Engagement duration typically ranges from several days for focused validation to multi-week engagements for complex or multi-tenant environments. Final scope and pricing are confirmed following structured discovery discussion.
